Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f50bb0b0af0689c…

MALICIOUS

PDF

29.1 KB Authoring application: Adobe PDF Library 9.0
MD5: 857be602527eb28b06ce2a9f63291943 SHA-1: f15c518cb8f2e12fb8582a8a62b41e701a605728 SHA-256: 9f50bb0b0af0689c78704686d1b2cc8157f10b235872981f2bd99d3c330f8698
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning or to redirect users to malicious sites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body, though heavily obfuscated, mentions 'Apache Junction MVD Office', suggesting a lure to impersonate a government service.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thetrailstownhomes.com/uploads/1/3/0/7/130739827/loguxorera.pdf
    • http://angelcare-refills.com/uploads/1/3/0/5/130588556/4385630.pdf
    • http://gardenrouteexploring.com/uploads/1/3/0/2/130272977/3330672.pdf
    • http://aikenkraft.com/uploads/1/3/0/7/130739188/bb1c2.pdf
    • http://menifeevaporpros.com/uploads/1/3/0/6/130605380/6846031.pdf
    • http://penaudiosolutions.com/uploads/1/3/0/5/130550711/6bfb9.pdf
    • http://williamskicthen.com/uploads/1/3/0/4/130436089/df0ca49f039.pdf
    • http://www.ucmv.us/uploads/1/3/0/3/130313289/buvofugevolekadatak.pdf
    • http://sweetblooms4u.com/uploads/1/3/0/4/130488213/jatepikef.pdf
    • http://www.gnhnlr.com/uploads/1/3/0/2/130287482/7cb7427349603.pdf
    • http://www.jarvisvapingsupply.com/uploads/1/3/0/7/130775370/kalun.pdf
    • http://hostmaster.kzo.site/uploads/1/3/0/8/130874591/130874591.html#apache+junction+az+mvd
    • http://sweetblooms4u.com/uploads/1/3/0/4/130488213/jatepikef

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001a0b.bin
505890aed78c5fe1f7f80429b601aa647709d594c8f775fd715aa29bdb22932a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A0B 7888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.