PDF malware analysis — malicious · ac269373b07de4f6

MALICIOUS

PDF

53.6 KB Authoring application: Solid Converter PDF

MD5: 6f2e401b6317703c04423ebb73f4c185 SHA-1: 9355b8418f689b7b76585bb7cc168f7681bd4181 SHA-256: ac269373b07de4f62c1cb81feb945e7903c97ed61f0d3cbc03d53250fa658d12

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique commonly used for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment. The primary attack pattern involves redirecting users through a network of linked PDFs hosted on various domains.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://carolinecolombo.com/uploads/1/3/0/4/130488662/5410285.pdf
- http://mail.motelmaxllc.com/uploads/1/3/0/8/130813079/mexalofovi.pdf
- http://am-pic.com/uploads/1/3/0/7/130775588/feral.pdf
- http://cpanel.geldersbewind.nl/uploads/1/3/0/4/130488884/xidazitajupanoporu.pdf
- http://taleday.org/uploads/1/3/0/6/130620480/1550419.pdf
- http://audia2dp.com/uploads/1/3/0/2/130271035/1748436.pdf
- http://www.keyautonj.com/uploads/1/3/0/2/130288577/tibowuri.pdf
- http://projecthomestead.us/uploads/1/3/0/2/130288549/puwujuzimutoxojuw.pdf
- http://www.amyrosvally.com/uploads/1/3/0/2/130270831/tomit-gimopulevul-bakidubu-kivuvulegotavu.pdf
- http://minneapolisinteriorpaintpros.com/uploads/1/3/0/3/130379843/mupirowewuviso.pdf
- http://motorbikeglasses.com/uploads/1/3/0/5/130590443/fuwatuk_pupibulizis_lilububu.pdf
- http://monetdiamondscollection.com/uploads/1/3/0/7/130775304/336029.pdf
- http://cruisencocktails.com/uploads/1/3/0/6/130604886/1663564.pdf
- http://emfeduresources.com/uploads/1/3/0/5/130544147/jonoxojewatapaxavis.pdf
- http://albertarescue.com/uploads/1/3/0/7/130738915/rutubog.pdf
- http://calasanzpbavaro.edu.do/uploads/1/3/0/6/130604699/2837183.pdf
- http://www.wingowin555.com/uploads/1/3/0/5/130589040/6115609.pdf
- http://fitosrestaurant.com/uploads/1/3/0/2/130288410/1af56bf135b3870.pdf
- http://scottsdalelandscapers.com/uploads/1/3/0/4/130436426/zanemuwi-dorunijegovogag-dojebafibase-pexizikile.pdf
- http://neilestrick.com/uploads/1/3/0/8/130813668/vadiranejaragakofawe.pdf
- http://slaughterhouseadventure.com/uploads/1/3/0/5/130588188/35123.pdf
- http://contractorconnection.biz/uploads/1/3/0/7/130775214/xekegafenikabogama.pdf
- http://www.goodidealschool.com/uploads/1/3/0/5/130551962/6b032c7.pdf
- http://www.casiken.info/uploads/1/3/0/8/130813330/cb4b07.pdf
- http://trecto.co/uploads/1/3/0/5/130540397/xuzomeveze_dagewaxatolaxor_xapebiteve_vuvenuka.pdf
- http://headblocks.org/uploads/1/3/0/2/130291358/130291358.html#prognosis+warm+autoimmune+hemolytic+anemia

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000052d0.bin` `ddc6c38a5929b263b215a5b0c7aa8b1a409f146866f06980111f9f21a6232bf4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x52D0	16036 bytes
`font_01_sfnt_off00006a7b.bin` `88b2393b9460a1a9af6a9f04537e57cb766105d8fbfa0097685ef18a3182ac81`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A7B	9588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.