Malicious PDF — malware analysis report

Static analysis result for SHA-256 b36c7da597df67d8…

MALICIOUS

PDF

51.7 KB Authoring application: Soda PDF
MD5: 3a3c4ac3bd9d73bc59562496aa914f15 SHA-1: 038dfa178f49f55d61458212cdd069f00621763d SHA-256: b36c7da597df67d8a082dd17ef12ef030e5df40552d2a7b7364c8ade12af3104
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files, a technique commonly used for SEO poisoning or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body itself appears to be corrupted or contains irrelevant text, but the primary malicious activity is the extensive link farm.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fhs1969.com/uploads/1/3/0/4/130435734/taxak_puzagasamiris_lijabiruv_masogolijofet.pdf
    • http://americanmusicnews.com/uploads/1/3/0/6/130639418/fe205ba4d67c.pdf
    • http://reveil-corporel.com/uploads/1/3/0/3/130324152/nitumofu.pdf
    • http://missinglinkbrewing.co.uk/uploads/1/3/0/5/130588461/wokotewa-tikala.pdf
    • http://sonoratradingpost.net/uploads/1/3/0/6/130605248/c19aa.pdf
    • http://themasher.net/uploads/1/3/0/5/130550949/dbde45.pdf
    • http://www.southbaybaby.com/uploads/1/3/0/6/130604046/3221596.pdf
    • http://electmorthland.com/uploads/1/3/0/6/130639559/tesujabalu.pdf
    • http://fearhouse.net/uploads/1/3/0/9/130969164/198de8f66.pdf
    • http://taskforce38.org/uploads/1/3/0/6/130620670/ripanigem-peguneri-lisozuweta-wafikiwexawipus.pdf
    • http://hostmaster.soleiragreen.com/uploads/1/3/0/6/130639412/73490.pdf
    • http://amywoodsbooks.com/uploads/1/3/0/6/130621089/9603593.pdf
    • http://jestersdesigns.com/uploads/1/3/0/7/130776749/1e26d82.pdf
    • http://naomiquinnphotography.com/uploads/1/3/0/4/130483322/zizizadutibunug.pdf
    • http://mta-sts.amateurhorsesales.com/uploads/1/3/0/7/130775075/rolekot.pdf
    • http://www.irenedkapinga.com/uploads/1/3/0/5/130588320/1223558.pdf
    • http://tuesdays4.com/uploads/1/3/0/3/130313415/tadaxuji-fibefa-nojoz-naxujanofe.pdf
    • http://travelbysharon.voyagerwebsites.com/uploads/1/3/0/7/130738632/130738632.html#download+279+ielts+essays+sample+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004dfa.bin
0acfc91a9332707a6be289fc4a0162b2ff3fb685652a1d34c8019039313e2bf6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4DFA 17460 bytes
font_01_sfnt_off00006ab7.bin
d650b32b076efaaf6e3f3cd7682c4350ae5c512bb886aca6830af68c97e41604		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6AB7 9664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.