Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad68be3ca7457f16…

MALICIOUS

PDF

49.7 KB Authoring application: Smallpdf Desktop
MD5: 48d1cc7d5a2fd24e18eb17327a12cd5b SHA-1: 7f51f44314ba267984aa5f305d977a9df602ccc8 SHA-256: ad68be3ca7457f160653ccc57766c95617f9bb45e0bd87804d2307e0f8816e7d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF documents. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent. The embedded URLs suggest a link farm designed to redirect users to potentially malicious content, likely for phishing or malware distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://miracleinabucket.com/uploads/1/3/0/5/130588591/bobapifepugo_pilapiwoti_xitilupatelema.pdf
    • https://gikuririgar.weebly.com/uploads/1/3/0/5/130588621/wovijogixiporu_tezoduxanedoj_nudovil_dujefen.pdf
    • http://historicalporttalbot.com/uploads/1/3/0/6/130621686/povusipego-didunivugibozen-topukenus-digulunopofigi.pdf
    • http://theanthonyseddonfund.org/uploads/1/3/0/3/130379246/4645354.pdf
    • http://bransfordmedpsych.com/uploads/1/3/0/5/130538842/sufibaf.pdf
    • http://browsmithmbc.com/uploads/1/3/0/4/130483300/basipa-tefiwizoji-jewusubabitazu.pdf
    • http://gpufx.com/uploads/1/3/0/6/130621701/e08c3e5a187fe18.pdf
    • http://psychotherapy121.org/uploads/1/3/0/3/130313082/ec235a4294.pdf
    • http://zambiasafarihunting.com/uploads/1/3/0/7/130738506/130738506.html#lagu+alec+benjamin+outrunning+karma

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000128d.bin
a7226b8e35ac188feec8be1373076c015b441741c5cd02cd6890681c20ea7c97		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128D 8100 bytes
font_01_sfnt_off000063f1.bin
04ef87053fb51d993717b73e4c0001b742b6e7e0d959117fd42c4dd5a5499df6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63F1 2372 bytes
font_02_sfnt_off00006e30.bin
4cddd4655211cebb9335a0cb6cb68e6a52c9a695899815e8f8e950386dc4beec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E30 16236 bytes
font_03_sfnt_off0000831f.bin
4e64255dde1697f3d161b67940b5e417ca61f3913f049be85744a25d7258584d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x831F 4216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.