Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa2a6e522dd0c203…

MALICIOUS

PDF

31.2 KB Authoring application: QPDF
MD5: 664d21f5a06a51a03037723654d1ed2a SHA-1: 8af2246741ce1aa4e732ac93b101742baee20dbb SHA-256: aa2a6e522dd0c20335a73e9b40c43deba8ae32df90a4e1db267f763d19461c85
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDF files. This behavior is indicative of a link farm designed to distribute malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body, though partially corrupted, references AASHTO bridge design specifications, likely a pretext to disguise the malicious link distribution. The primary attack pattern involves tricking users into clicking these links to download further malware.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://southerncrossland.com/uploads/1/3/0/7/130776142/9e2fb.pdf
    • http://www.cqudigitaltaskcards.com/uploads/1/3/0/2/130273790/jejoj.pdf
    • http://caesarjewels.nl/uploads/1/3/0/5/130589191/683a74f.pdf
    • http://aphroditedivineunionteachings.com.au/uploads/1/3/0/3/130313748/fipurofizifepulugafe.pdf
    • http://addisonfluids.com/uploads/1/3/0/5/130551008/3ba49c.pdf
    • http://psykhoshop.com/uploads/1/3/0/3/130323511/wedobewokemuxeroged.pdf
    • http://niagaracountycsd.services/uploads/1/3/0/4/130435722/b7ae1e.pdf
    • http://apslabgroup.com/uploads/1/3/0/7/130775357/7627494.pdf
    • http://www.fachapotheke-seltene-krankheiten.at/uploads/1/3/0/5/130543684/rokuxadonuzuvem-sufivu.pdf
    • http://amlanordstages.com/uploads/1/3/0/6/130604263/5496670.pdf
    • http://thestation.org/uploads/1/3/0/5/130546354/2259324.pdf
    • http://dereli.nl/uploads/1/3/0/5/130544494/pigumoliliworo_seveze.pdf
    • http://pdxsimplechurch.org/uploads/1/3/0/7/130739567/vonavo_tufedox.pdf
    • http://rockstarsproductions.com/uploads/1/3/0/7/130776724/xemel_fizupepo_kupadoduboxo_lifiwijebep.pdf
    • http://septicsystemcost.net/uploads/1/3/0/7/130776866/85ff03118c2a1.pdf
    • http://host242.carmichaelnl.com/uploads/1/3/0/4/130483805/130483805.html#aashto+bridge+design+specifications+cl+3.6.1.2

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001fb5.bin
20089dd9d81670f0571452b289a6ed7502fd54ec0e459c16447da8faf1815ddc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FB5 7512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.