PDF malware analysis — malicious · ae21a570f13d6fd8

MALICIOUS

PDF

42.5 KB Authoring application: Adobe PDF Library 9.0

MD5: 900ef26370732d8908330b99814c57b3 SHA-1: ab0a1fd2b3e815c7388281141f5b05cec6806127 SHA-256: ae21a570f13d6fd820bca10bdd164a3617780364ffe065c11213b0d6752d16e3

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various external domains, suggesting a link farm or a phishing distribution network. The ClamAV detection further confirms its malicious nature, classifying it as Pdf.Phishing.TtraffRobotInstall. No scripts were extracted from this sample, but the sheer volume of outbound links indicates a high likelihood of malicious intent, such as SEO spam or redirecting users to malicious sites.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://sharkhunterapparel.com/uploads/1/3/0/5/130550854/30e6d60231d.pdf
- http://coastalchurchmaine.com/uploads/1/3/0/3/130379475/tavexipefa-tajidipekubi.pdf
- http://mylifeisamesspodcast.com/uploads/1/3/0/6/130604793/c62f5a93.pdf
- http://poolesvillepickers.com/uploads/1/3/0/5/130589214/0f662cb62bed.pdf
- http://savethetreespdx.com/uploads/1/3/0/8/130813604/vereje-nesarotenixer.pdf
- http://danielshogilev.com/uploads/1/3/0/2/130287424/8eeb099.pdf
- http://unique-cures.com/uploads/1/3/0/6/130621840/b6ef30.pdf
- http://comicscheap.com/uploads/1/3/0/8/130874614/3d542924436d0e2.pdf
- http://andrenathletics.com/uploads/1/3/0/3/130323423/tazatatut.pdf
- http://nutritionunique2u.com/uploads/1/3/0/3/130323478/fa0ca5b49c.pdf
- http://striveprogram.com/uploads/1/3/0/7/130776409/rinali.pdf
- http://goodtogodiets.com/uploads/1/3/0/2/130272254/53369e94.pdf
- http://www.tyroltraverse.com/uploads/1/3/0/5/130551441/99ffd66397.pdf
- http://autosafenow.com/uploads/1/3/0/6/130604823/8074083.pdf
- http://24h-loodgieter.be/uploads/1/3/0/6/130621852/fubarem.pdf
- http://imperfectwitch.com/uploads/1/3/0/4/130476262/9078276.pdf
- http://monsieurcoulibaly.com/uploads/1/3/0/5/130588564/gugujizu_dovanetibex_gikenipudup_pemurujodele.pdf
- http://plyosoul.net/uploads/1/3/0/6/130621426/zuvenawomuni-mivuvakunimuno-zijenamimakek-nudolid.pdf
- http://nicholslawpdx.com/uploads/1/3/0/4/130476263/kogofatoju_wupekezazanefag_lonowimalerike.pdf
- http://room2dream.net/uploads/1/3/0/7/130776101/ratazuzuzorav_dozerelajelaba.pdf
- http://bytcorp.org/uploads/1/3/0/4/130488273/5131469.pdf
- http://enclaveusa.com/uploads/1/3/0/5/130590716/sovupax_bakogaxitetu_vudobux.pdf
- http://authorjulievail.com/uploads/1/3/0/5/130545173/nukeduxodefupibawu.pdf
- http://rep-christ.com/uploads/1/3/0/7/130740180/rerodoxi.pdf
- http://www.shakti-circus.com/uploads/1/3/0/6/130639124/zigolur-funekubesebu.pdf
- http://nonconformist0.pleasingfood.com/uploads/1/3/0/7/130775451/130775451.html#ielts+reading+passage+2+tidal+power

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004046.bin` `3aca3e245d695b6c08a179ab1021ae0f752a5ae718230d83c70ccd9ccdfc7e12`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4046	8512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.