Malicious PDF — malware analysis report

Static analysis result for SHA-256 b65a84f631d21188…

MALICIOUS

PDF

35.1 KB Authoring application: QPDF
MD5: 4a26017a827f52022c73e8810c37f644 SHA-1: 376daaca8553898643590fc11d67bc3a6c00fded SHA-256: b65a84f631d2118859a41365b6f3e1c89819328dfd038118630f0e13fadbefbe
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm designed to distribute malicious content, likely phishing or malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. The document body's text, while partially obfuscated, mentions converting PDFs and includes numerous URLs, reinforcing the lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://usrailmap.com/uploads/1/3/0/7/130739835/894957.pdf
    • http://nordicatravel.net/uploads/1/3/0/5/130588913/pejer_wanoboteta_zapagapolaxag.pdf
    • http://www.headlandparkartistprecinct.com/uploads/1/3/0/4/130488736/dazetaxikefok_wovusi.pdf
    • http://pvbcommunications.com/uploads/1/3/0/7/130738635/dulanok_peluv_pejujapunewisa_zirodererotizu.pdf
    • http://allthingstax.org/uploads/1/3/0/6/130603994/dirajulazo.pdf
    • http://registrationdogpapers.com/uploads/1/3/0/3/130379141/3530970.pdf
    • http://mistysaromaticboutique.com/uploads/1/3/0/6/130621063/6475993.pdf
    • http://school-playground-equipment.com/uploads/1/3/0/2/130274281/6492854.pdf
    • http://flowersbychilton.co.nz/uploads/1/3/0/2/130272903/nezati.pdf
    • http://mymontagne.com/uploads/1/3/0/2/130288510/davijiwiraw.pdf
    • http://theorchardhouse.net/uploads/1/3/0/2/130287847/5956587.pdf
    • http://svetsfiltar.com/uploads/1/3/0/7/130775810/birepudafogij.pdf
    • http://notimeforme.net/uploads/1/3/0/6/130621367/d8f2dd.pdf
    • http://333tools.com/uploads/1/3/0/7/130739470/begaboga.pdf
    • http://barbaraweiderhouse.ca/uploads/1/3/0/7/130775640/71c6d0907a.pdf
    • http://footcentersofnorthcarolina.com/uploads/1/3/0/4/130435694/xarilanerozo.pdf
    • http://host242.carmichaelnl.com/uploads/1/3/0/5/130541597/130541597.html#convert+pdf+to+fillable+form+acrobat+x+pro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002dd7.bin
5aea17901250130bd3f75e23970444463779c66a4c69401d4d539427ea3b2d60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DD7 7764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.