Malicious PDF — malware analysis report

Static analysis result for SHA-256 a592cf3bdc6edebf…

MALICIOUS

PDF

47.0 KB Authoring application: Soda PDF
MD5: 905654be1767c59401afae9f005a9817 SHA-1: 22a8468b31fe170756eff8708470b9b4fd526a47 SHA-256: a592cf3bdc6edebff66156d7c10bfc4c1f54a844d3bfc06a88fd741dc1c2e7aa
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, forming a link farm. The document body, disguised as IELTS reading material, is likely a lure to encourage users to click these links. The ClamAV detection and the PDF_SEO_LINK_FARM heuristic strongly indicate a malicious intent, likely for phishing or driving traffic to malicious sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://budsmotorauctions.com/uploads/1/3/0/6/130620728/lopowifiseber-rekujodefidibug-zudiwixob.pdf
    • http://www.wanigelawatersecurity.com/uploads/1/3/0/4/130489159/f62a0df.pdf
    • http://toxiconsult.com/uploads/1/3/0/6/130620965/gikegepake.pdf
    • http://tienerdisco.net/uploads/1/3/0/5/130539238/wawixakiborejofane.pdf
    • http://stylogentlemensweekend.com/uploads/1/3/0/4/130476491/duberalitozivu_tazob.pdf
    • http://life-in-full-empowerment.net/uploads/1/3/0/7/130740117/43e098015b662.pdf
    • http://church-playgroundequipment.com/uploads/1/3/0/8/130814687/2549108.pdf
    • http://raycoffee.net/uploads/1/3/0/4/130476101/5609695.pdf
    • http://fullerlifecounseling.com/uploads/1/3/0/4/130435905/dinezelumi.pdf
    • http://motorcycl-ng.com/uploads/1/3/0/4/130475965/7982266cf.pdf
    • http://opk4g.salon225.com/uploads/1/3/0/6/130621076/130621076.html#ielts+reading+topic+a+chronicle+of+timekeeping

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b4e.bin
5a9695438bb362a8b10d86f415c06da9d71f416851af8c6c9c762304ce3c8158		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B4E 16088 bytes
font_01_sfnt_off000062d4.bin
0c6d69f40f4abe46e54f1a5a19a76bf11929f505346d300aa185530b013ce9ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62D4 7832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.