Malicious PDF — malware analysis report

Static analysis result for SHA-256 afdcd623acb0c893…

MALICIOUS

PDF

38.0 KB Authoring application: PDF Studio
MD5: 68c601e89e637aa5ae1d2d1335c3dd81 SHA-1: b7d970968e85e5c42dcb782349c9198c7f8d627b SHA-256: afdcd623acb0c893901a423161bb0ddad72424edb3f9d74ada18ff1d7a1d1c6e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, disguised as a document explaining adverbs of frequency, which is a common lure for phishing or malware distribution. The ClamAV detection and the PDF_SEO_LINK_FARM heuristic confirm the malicious intent of distributing multiple external PDF files. The embedded URLs are the primary indicators of compromise.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://traind.me/uploads/1/3/0/7/130739596/rufidojaza.pdf
    • http://cosy-home.org/uploads/1/3/0/4/130483868/755796.pdf
    • http://camposinsuranceagency.com/uploads/1/3/0/3/130379423/4691a.pdf
    • http://soildsurfacewarehouse.com/uploads/1/3/0/5/130551218/7744169.pdf
    • http://viralpaws.com/uploads/1/3/0/2/130289284/nusomusobigan-fotanet-xuvekixasasaxu.pdf
    • http://elementecommerce.com/uploads/1/3/0/6/130604256/daserigese_muzonedevixabaz_mufakavus_susotumoxegor.pdf
    • http://asbpw.com/uploads/1/3/0/5/130543320/e19680b56c54.pdf
    • http://blindsquirrelcreativedesign.com/uploads/1/3/0/6/130604482/3120665.pdf
    • http://lindsayslittlecookingacademy.com/uploads/1/3/0/2/130271240/koritedofu_nidademet_vedipukapimugu_jevalelolokapaj.pdf
    • http://carolynsandstrom.com/uploads/1/3/0/5/130540926/3608556.pdf
    • http://miracleinabucket.com/uploads/1/3/0/5/130539697/130539697.html#adverbs+of+frequency+examples+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001314.bin
9afc3b617d3e412d880f49e8a8527298ebd67cbcebb8838f95a787b8ca5cda2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1314 8764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.