Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac0dcb8aef1385ef…

MALICIOUS

PDF

37.6 KB Authoring application: Smallpdf Desktop
MD5: 01327c66eec808043adb3c3b59fb672f SHA-1: dbdc3b41edfe6dcd11a0c01fc5184ee5b47e2a9e SHA-256: ac0dcb8aef1385eff1a15787bb50ba07601d82adc5193f0f5dc85e2c9977470a
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links to other PDFs, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of embedded URLs strongly suggest a phishing or malware distribution campaign. The document body, though heavily corrupted, contains phrases related to PDF software, likely a lure to encourage downloads.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hardwarebridge.com/uploads/1/3/0/8/130813859/dolik.pdf
    • http://scottgieser.com/uploads/1/3/0/5/130589094/378bd6e3d.pdf
    • http://myescondidosoccer.com/uploads/1/3/0/2/130287513/lirasejot.pdf
    • http://sg.camisashabers.com.mx/uploads/1/3/0/6/130621607/98b82f.pdf
    • http://robyntapley.com/uploads/1/3/0/4/130488732/nikexogerinatuj.pdf
    • http://weworkdistributed.life/uploads/1/3/0/5/130550704/c28c5740.pdf
    • http://www.thesoundofthecoldwar.com/uploads/1/3/0/3/130313414/xofuki.pdf
    • http://daviddcal.com/uploads/1/3/0/5/130590363/6041614.pdf
    • http://nashobaspeechandfeeding.net/uploads/1/3/0/2/130270747/223499.pdf
    • http://a-custom-esl-tutoring.com/uploads/1/3/0/6/130640163/4547123.pdf
    • http://beginningphpandmysql.com/uploads/1/3/0/7/130740389/3dbc27a98827e12.pdf
    • http://quorp.com/uploads/1/3/0/5/130541103/5b54bc798541b3.pdf
    • http://0negocios.biz/uploads/1/3/0/6/130639110/59c6b1cb1a1.pdf
    • http://sthfromnth.com/uploads/1/3/0/6/130620337/lonidosumuvejadevos.pdf
    • http://keithharleystyle.com/uploads/1/3/0/7/130740590/92979cf0020c865.pdf
    • http://digital-chicago.org/uploads/1/3/0/4/130476309/dekipiwor.pdf
    • http://anongroup.org/uploads/1/3/0/2/130288565/3265445.pdf
    • http://firebirdpoker.com/uploads/1/3/0/5/130589033/0765a9ddd4050.pdf
    • http://transportedepianosymudanza.com/uploads/1/3/0/6/130639994/9699402.pdf
    • http://benton-jp.com/uploads/1/3/0/5/130589316/f5e215e.pdf
    • http://nestednotebooks.org/uploads/1/3/0/7/130739088/e081abd61d.pdf
    • http://granhotelmonterrey-es.devsite-1.com/uploads/1/3/0/4/130488273/130488273.html#free+download+pdf+reader+software+for+windows+7
    • http://sthfromnth.com/uploads/1/3/0/6/130620337/lo

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000315c.bin
c84f8f63ca5bff7507aefbb39e25e2118754b856f33d9e472a15bee5f8e95065		 pdf-font-stream PDF embedded font (sfnt) at offset 0x315C 8244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.