Malicious PDF — malware analysis report

Static analysis result for SHA-256 a15723ff0942c313…

MALICIOUS

PDF

28.5 KB Authoring application: GIMP
MD5: 7abcf59fdf0a4f35aff11d5bf87caf9b SHA-1: 0af736dad0ebc7127e88a84e823c0c5d0c7dcbd8 SHA-256: a15723ff0942c313fbf9471e672aa486689f6d13bdaf3d1d65db55e477e7a01f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The document body, though containing some obfuscated text, includes references to 'standardized test practice answers geometry' and lists multiple URLs, suggesting a lure to external content. The primary attack pattern involves directing users to a link farm, likely for SEO manipulation or to serve malicious payloads.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://weseveralu.weebly.com/uploads/1/3/0/5/130541384/84992d4c28.pdf
    • http://repagewo.baikalist.com/uploads/2020/01/27/8828714.pdf
    • http://kcranchllc.com/uploads/1/3/0/6/130604639/fituteluxodegolo.pdf
    • http://thekimrichardson.com/uploads/1/3/0/5/130543877/0c50fcb9e846a4.pdf
    • http://azvrha.org/uploads/1/3/0/5/130550654/takogabimelimikoxa.pdf
    • https://fozepitiv.weebly.com/uploads/1/3/0/6/130604036/bebomor.pdf
    • http://carpetcleancary.com/uploads/1/3/0/5/130543488/130543488.html#chapter+9+standardized+test+practice+answers+geometry

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001070.bin
5f72180aedf063af89ce281c38277fc663c6e52fd8689a910b8e381f0fdd88f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1070 7104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.