Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa34c9d5fa68ba20…

MALICIOUS

PDF

37.0 KB Authoring application: QPDF
MD5: 8b6d48ba4ff92e7378f909f8a83dcd6f SHA-1: 30eb879202c278ac8bae510cc399a406c5eb2ac9 SHA-256: aa34c9d5fa68ba202fbc33c6033e2cd29fd4938055f1abab1a32b54f10d4131c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection also confirms its malicious nature, specifically flagging it as phishing-related. No scripts were extracted from this sample, and the document body content is largely unreadable due to encoding issues.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://trumanrocks.com/uploads/1/3/0/7/130738970/8145542.pdf
    • http://sportsgrinding.com/uploads/1/3/0/7/130738855/gomada.pdf
    • http://darwinlazatinphotography.com/uploads/1/3/0/6/130604869/1fec26.pdf
    • http://davidcarere.com/uploads/1/3/0/8/130874325/zanawapunalu-butuw.pdf
    • http://metdonuts.com/uploads/1/3/0/6/130620849/5427506.pdf
    • http://marculeroyal.com/uploads/1/3/0/6/130604233/sonofe.pdf
    • http://www.aau-atlanticcoastwrestling.com/uploads/1/3/0/7/130776617/mivapemuzesuzezu.pdf
    • http://elizabethskipper.com/uploads/1/3/0/6/130604654/8675277.pdf
    • http://mexitem.com/uploads/1/3/0/2/130291596/jukivisapataxipamuzi.pdf
    • http://kupetspinkinvitational.com/uploads/1/3/0/7/130740618/8e22683b0a8c52.pdf
    • http://construction-staffing.com/uploads/1/3/0/7/130739401/gekuxipululare.pdf
    • http://vailpedicab.com/uploads/1/3/0/6/130605270/52289dcd82b0.pdf
    • http://www.dariablond.com/uploads/1/3/0/6/130621503/linumaguwanek_muzolal_levagafib_vumiritatixux.pdf
    • http://amandabates.com/uploads/1/3/0/4/130435738/baponur-wifekijuwopikok.pdf
    • http://www.forgottenindustry.com/uploads/1/3/0/2/130287242/fb6ee03bd.pdf
    • http://alwalsh-threeflightsup.com/uploads/1/3/0/2/130287394/dijavumunod-mogidokiwiniwe-vuxifuxapexepuw.pdf
    • http://getthatdirtcleaning.com/uploads/1/3/0/4/130435644/936c487e9.pdf
    • http://mountephraimtaxpayersfirst.com/uploads/1/3/0/6/130620662/rotas_welozazofewe_nozase_wimezodemazax.pdf
    • http://aux3ponts.com/uploads/1/3/0/3/130323462/37f3dccf53b01.pdf
    • http://www.juliehuffman.net/uploads/1/3/0/8/130814129/valiwazovezenefadon.pdf
    • http://p9jzm.slpny.com/uploads/1/3/0/6/130604583/130604583.html#alk+phosphatase+in+pregnancy
    • http://marculeroyal.com/uploads/1/3/0/6/130604233/sono

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030d8.bin
f3f5ab187edf7775cc864736becad260fcb404f87ae6c96e551a20fcf5fcb695		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30D8 7924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.