Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7b150fda39c52df…

MALICIOUS

PDF

40.0 KB Authoring application: Mobipocket Creator
MD5: 5da2a70eadf7a048cf130bae28926662 SHA-1: eff75d7bbc9afd8c6a25e37003c6d8c421eda339 SHA-256: b7b150fda39c52df8a025597c4ce25e0b18605180f85a372a72bff874e433297
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a significant number of embedded external links, indicating a link farm. The primary purpose appears to be directing users to a large collection of other PDF files hosted across various domains. The document body contains garbled text, suggesting it is not intended for direct user consumption but rather as a container for the malicious links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://indigenousalaska.com/uploads/1/3/0/5/130539414/vurozezofotogi_zaromepajadux.pdf
    • http://www.ufo-studies.com/uploads/1/3/0/8/130814393/8e856e.pdf
    • http://lightningreleases.net/uploads/1/3/0/4/130476346/7729932.pdf
    • http://meteorcrater.us/uploads/1/3/0/6/130621413/rowalef_pasaburu.pdf
    • http://dallasmendingminds.com/uploads/1/3/0/5/130588328/nomakega.pdf
    • http://www.allentown-pa-personalinjurylawyers.com/uploads/1/3/0/9/130969176/kejasomomekufu.pdf
    • http://nodeberiacontarlo.com/uploads/1/3/0/5/130551720/fimogijigov-fabubi.pdf
    • http://love100foryou.com/uploads/1/3/0/6/130603855/847888.pdf
    • http://www.strawberrygoosephotgraphy.com/uploads/1/3/0/6/130604532/gekijisebugedox.pdf
    • http://virtualaiims.org/uploads/1/3/0/4/130488085/parotatuwim.pdf
    • http://thingsome.com/uploads/1/3/0/6/130620395/696513444b.pdf
    • http://exceptionaleducators.org/uploads/1/3/0/6/130621708/58ad1e24703e86.pdf
    • http://pittosporumgolfball.com/uploads/1/3/0/5/130551124/4964149.pdf
    • http://ecloudco.com/uploads/1/3/0/6/130639259/6481538.pdf
    • http://prairierockconstruction.com/uploads/1/3/0/4/130483761/zomumufo.pdf
    • http://michsblingboutique.com/uploads/1/3/0/6/130603838/6612735.pdf
    • http://kishwaleather.com/uploads/1/3/0/7/130775267/wakatusowawum.pdf
    • http://yourethicalwill.org/uploads/1/3/0/5/130588527/7d9a004f085c8f6.pdf
    • http://themodcube.com/uploads/1/3/0/2/130273610/xivepel.pdf
    • http://hostmaster.rollepodiatry.co.uk/uploads/1/3/0/5/130543511/lolago.pdf
    • http://money-spinner-uk.com/uploads/1/3/0/2/130289719/1922910.pdf
    • http://pantherfightteam.com/uploads/1/3/0/5/130589299/368226.pdf
    • http://morbegnoclassica.com/uploads/1/3/0/6/130640236/5013028.pdf
    • http://cww60.bpmtc.com/uploads/1/3/0/2/130288318/130288318.html#what+is+the+difference+between+orthopnea+and+paroxysmal+nocturnal+dyspnea
    • http://pittosporumgo

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003abd.bin
7680df55cb30668a5cb5171b61387a3c2db633d3ce05d988878cdb26ebde0004		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3ABD 7608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.