Malicious PDF — malware analysis report

Static analysis result for SHA-256 b077fba7cb94db28…

MALICIOUS

PDF

60.8 KB Authoring application: Solid Converter PDF
MD5: 4a2d56464882319b5d34b2b4007a6484 SHA-1: d1a052e176730ecf6e337c77621b3145fb8d1fc1 SHA-256: b077fba7cb94db28a12c8cc4a22b1dc3bd7f1eeffa5636b19380157cb43b5b82
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files across various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and redirection intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://arx200.com/uploads/1/3/0/7/130740385/losufodukibonex.pdf
    • http://auntkates.com/uploads/1/3/0/3/130379150/visigisof-vijizuroxefo.pdf
    • http://mybeauty.services/uploads/1/3/0/4/130483338/1795199.pdf
    • http://speechtherapynorcal.com/uploads/1/3/0/4/130476215/dowuxedadezewox_xalozazebo.pdf
    • http://dewarinternational.com/uploads/1/3/0/2/130270869/sadasix-papitazexari-bodefire.pdf
    • http://comedybeastradio.com/uploads/1/3/0/6/130620464/norana.pdf
    • http://www.maevanaturals.com/uploads/1/3/0/6/130639672/lupufoze-nibawuna-sajepotiridimik-sotuwugebogal.pdf
    • http://debkatzdesign.com/uploads/1/3/0/2/130271165/jiwozegotu.pdf
    • http://www.skybetweentheleaves.com/uploads/1/3/0/7/130775154/gepijevebo_mapomoga_putagil.pdf
    • http://doug-jones.com/uploads/1/3/0/6/130605387/puzevakubiv.pdf
    • http://www.elizg.com/uploads/1/3/0/4/130488780/9198549.pdf
    • http://monicarayscott.com/uploads/1/3/0/7/130775048/tajotilimizagek.pdf
    • http://zuiderhavendijkconcert.com/uploads/1/3/0/2/130270785/4b0c1.pdf
    • http://imaginationinnovation.co.uk/uploads/1/3/0/4/130435725/a944df930a7.pdf
    • http://starruchii.com/uploads/1/3/0/6/130605216/8333939.pdf
    • http://hostmaster.avphospitals.org/uploads/1/3/0/7/130776695/sopagezijesi.pdf
    • http://mindfactek.org/uploads/1/3/0/5/130590550/pikosuso_daduxunulasa.pdf
    • http://ministryiq.net/uploads/1/3/0/8/130873864/lowunakavudug.pdf
    • http://mindfulnessinoregoncity.com/uploads/1/3/0/6/130639404/megisiwepok.pdf
    • http://cyclonelanguagearts.org/uploads/1/3/0/6/130604101/1877141.pdf
    • http://suitestravel.voyagerwebsites.com/uploads/1/3/0/3/130323415/130323415.html#cards+against+humanity+absurd+box+directions

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000113c.bin
74955ba8f54ebbdc3228f011b5f3b65a91cc4e48643371a1ac88fafe8a0d06ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113C 9252 bytes
font_01_sfnt_off00009184.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9184 16036 bytes
font_02_sfnt_off0000a59b.bin
87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA59B 2596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.