Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1edcc350c8ea525…

MALICIOUS

PDF

53.5 KB Authoring application: Inkscape
MD5: 7a6b1945032555c59c1e02a2ad64045a SHA-1: d2d78fd4da457d040334a95078917b785cce5ea2 SHA-256: a1edcc350c8ea52538af879b5ab113259498860d074001fdc5bd6552cb2b5272
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to other PDF files, a technique often used for SEO poisoning or to distribute malicious content. The document body mentions 'Adobe after effects cs6 12.0 cc download', suggesting a lure for users seeking software. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a phishing or traffic redirection intent. The embedded URLs likely lead to further malicious content or phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://occseagles.org/uploads/1/3/0/5/130588778/betuwaki-xivag-vunikozinejag.pdf
    • http://putakings.com/uploads/1/3/0/4/130436226/66ae60b.pdf
    • http://softcom.live/uploads/1/3/0/5/130588790/7996843.pdf
    • http://ourvillagefarmacy.com/uploads/1/3/0/2/130289380/gopovezizemipona.pdf
    • http://puz.crimeacadastre.ru/uploads/2020/01/27/3745162.pdf
    • http://toptreeservicerosevilleca.com/uploads/1/3/0/5/130544091/9461476.pdf
    • http://autovairavimas.com/uploads/1/3/0/3/130379597/vulovafowuxul.pdf
    • http://mindfulevolution.net/uploads/1/3/0/2/130289262/70517d31.pdf
    • http://blessedtexandesign.com/uploads/1/3/0/6/130639786/1d0a57cdfbfa.pdf
    • http://naturalgasgarbagetruck.net/uploads/1/3/0/6/130605412/nukexaxogomo.pdf
    • http://11pluscolchester.com/uploads/1/3/0/5/130539757/7414226.pdf
    • http://juliejesternewman.com/uploads/1/3/0/4/130493389/130493389.html#adobe+after+effects+cs6+12.0+cc+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013d9.bin
c69f9452b0766d5486987af0a5141d662f4ad22fd8c4da9ac254da6c54c57a20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D9 11200 bytes
font_01_sfnt_off000083d8.bin
7eab1069ef670ea69d98f2c05bfa1c501b56ef774799f4f576316019a8bd89b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x83D8 21652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.