Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5356fb356ddb327…

MALICIOUS

PDF

39.6 KB Authoring application: ImageMagick
MD5: 589ceb0e98f291d149e3cfc2f3cd1fff SHA-1: c7c969c782ecc430928b62047e55bc23334cb345 SHA-256: a5356fb356ddb32764ddbc621c104e414e846552a5a3fa9bce866ad42997838c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to host malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample, limiting the analysis of direct execution capabilities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oslorelocationservices.com/uploads/1/3/0/5/130590779/2848769.pdf
    • http://northeastmolosserdogclub.org/uploads/1/3/0/6/130604525/7495968.pdf
    • http://neuropathydoctors.net/uploads/1/3/0/4/130488694/4621843.pdf
    • http://learnfaces.com/uploads/1/3/0/4/130483650/dexapeladogapo.pdf
    • http://backstage.one/uploads/1/3/0/8/130813526/9818168.pdf
    • http://automateforgood.com/uploads/1/3/0/5/130589366/nozogozanozubovefi.pdf
    • http://mobile.cactuscompression.com/uploads/1/3/0/5/130589411/somesexofuxibo.pdf
    • http://www.istitutodonboscoroma.com/uploads/1/3/0/8/130874175/5058315.pdf
    • http://thedownsideofbliss.com/uploads/1/3/0/4/130490643/wobirodot-sapuno.pdf
    • http://www.halftheskydesigns.com/uploads/1/3/0/5/130543743/5334841.pdf
    • http://www.wiredbohemian.net/uploads/1/3/0/6/130603715/juvidigeseb.pdf
    • http://snehsrivastava.com/uploads/1/3/0/6/130639786/7146037.pdf
    • http://brooksmotocrossclub.com/uploads/1/3/0/2/130288932/0b4a614fb2dce0a.pdf
    • http://quitatlast.com/uploads/1/3/0/5/130588437/6119206.pdf
    • http://duckiesuds.com/uploads/1/3/0/7/130776113/kajerateladodaw.pdf
    • http://larocquemedicalcentre.com/uploads/1/3/0/6/130603823/difiwenaliroxi.pdf
    • http://x0524609xstreamtravel.xsideas.com/uploads/1/3/0/6/130620865/130620865.html#edit+text+in+photoshop+file
    • http://mobile.cactuscompres

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003376.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3376 2600 bytes
font_01_sfnt_off00003f10.bin
9bf2b4da6368e3765c4e984e346beb9e7284be9998094451010f57e7db7298f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3F10 7980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.