Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7655d19da2bec65…

MALICIOUS

PDF

43.3 KB Authoring application: PDF Studio
MD5: 507607de7b31a4bb72b5274d999f6986 SHA-1: 63e4b22e948841f27dfec7091ae62ac146e94f21 SHA-256: b7655d19da2bec6510c552f4142c92a7eb903a81d13f9a93b096b844b76ba6ba
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was detected as malware by ClamAV, specifically 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a large number of embedded external links, characteristic of a link farm used for SEO poisoning or phishing campaigns. The primary heuristic identified a mass external PDF link farm with 18 links, predominantly hosted on 'no.revivalmission.org'. The document body contains garbled text, suggesting it is not intended for direct user interaction but rather as a container for these malicious links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://no.revivalmission.org/uploads/1/3/0/6/130621000/9c8f0c.pdf
    • http://literaturepsychology.com/uploads/1/3/0/7/130776316/57f557e.pdf
    • http://hipsterleaks.com/uploads/1/3/0/4/130479435/842007.pdf
    • http://creepyen.com/uploads/1/3/0/2/130272918/7224682.pdf
    • http://gracetrimble.info/uploads/1/3/0/5/130588438/a87dfc7fed.pdf
    • http://kayozf5.com/uploads/1/3/0/7/130739631/4395583.pdf
    • http://ichoosetoriseup.com/uploads/1/3/0/7/130776055/zisuleworuwuvem.pdf
    • http://adamhenryink.com/uploads/1/3/0/6/130620365/54f1fd5bc2672.pdf
    • http://easterncarpetcleaning.com.au/uploads/1/3/0/3/130323291/fepiwigeniwusu.pdf
    • http://bbcsalberta.com/uploads/1/3/0/4/130476481/bubawu-piwule-redokejojoxesi-wopigejopobaxob.pdf
    • http://sunshineautocars.com/uploads/1/3/0/2/130289694/xuguxa.pdf
    • http://www.swimminwitdafishes.com/uploads/1/3/0/7/130739232/9776bccba4dcc0.pdf
    • http://mojeplc.sk/uploads/1/3/0/3/130323630/tijuvumuvut-towewidobizuz-gesoduzebajapog-notulinixagasuz.pdf
    • http://madamdeclutter.com/uploads/1/3/0/6/130640231/c0d89b7921e9bb1.pdf
    • http://vigilanttool.com/uploads/1/3/0/8/130813859/falugagerodim.pdf
    • http://cwhypnotherapy.com/uploads/1/3/0/7/130740011/wizamemezami.pdf
    • http://www.sexeparadisco.com/uploads/1/3/0/8/130813461/68ceb6.pdf
    • http://sixiememonde.info/uploads/1/3/0/6/130603815/ab8d0ef.pdf
    • http://1sx.brdge.org/uploads/1/3/0/6/130639685/130639685.html#akiane+kramarik+biografia
    • http://mojeplc.sk/uploads/1/3/0/3/130323630/tijuvumuvut-towewidobizuz-ges

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031c3.bin
1460b814ca90d308978ae1a2e9faca7dd2e31fd822326517da42a6f188b1da79		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31C3 16232 bytes
font_01_sfnt_off000049fe.bin
b15a4199a040dfafae1030c0dccaacc55a4f8cf10583a0e6967277257a19bf00		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49FE 8404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.