Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4b49b9502ec79bd…

MALICIOUS

PDF

33.9 KB Authoring application: Pdftk
MD5: 61de26e6bd6698f0590823e375cc62e3 SHA-1: 049814142253c9d079b2533c11ca36153a79c534 SHA-256: a4b49b9502ec79bd557524a39ee0644424431c964fd821824084d79431328159
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The embedded URLs suggest a phishing or SEO spam campaign, aiming to redirect users to potentially malicious content hosted on various domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ddjd.ie/uploads/1/3/0/7/130739454/pinekava.pdf
    • http://diwaku.id/uploads/1/3/0/7/130775565/desavozetirenabiduwe.pdf
    • http://mail.chocolatelover.ph/uploads/1/3/0/6/130604791/devigatewobexu.pdf
    • http://pitneyproductions.com/uploads/1/3/0/7/130775525/kezepo-rugowuzadikez-vowupepibip-nobosanediku.pdf
    • http://30wallst.com/uploads/1/3/0/4/130436089/eaa9fa59.pdf
    • http://tradeshowarizona.com/uploads/1/3/0/6/130620678/8320358.pdf
    • http://shelbycolgan.com/uploads/1/3/0/8/130873894/5fb2a.pdf
    • http://www.woodhavenlane.com/uploads/1/3/0/8/130873908/megekilow_xixezi_zodeze_foxititepi.pdf
    • http://www.wickededgeproducts.com/uploads/1/3/0/7/130740443/bazonodafobig.pdf
    • http://bestofthemenu.com/uploads/1/3/0/7/130739086/babbaad4aae79.pdf
    • http://123klart.se/uploads/1/3/0/7/130739712/4184260.pdf
    • http://www.xjiang.me/uploads/1/3/0/4/130489361/fd7f94.pdf
    • http://shopbelfast.info/uploads/1/3/0/6/130604209/130604209.html#convertidor+pdf+a+excel+sin+perder+formato+online

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002a94.bin
819a314d2e17615c67a2db5e6b1209bcc75e34a0f8d75fe31681ddc5b42f65a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A94 9016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.