Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc24669ef0a55a73…

MALICIOUS

PDF

35.1 KB Authoring application: PDF Studio
MD5: ff1d6f1d0af3969bc34601f280b0b3f5 SHA-1: 22829f037d5659cf5c31d709070a893293ad36ea SHA-256: bc24669ef0a55a73b44594b9ffb74697408881d0754dd5ac34ac3cbc4bc961d3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to external PDF documents hosted on various unrelated domains. This behavior is indicative of a link farm or a phishing lure, designed to direct users to potentially malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hostmaster.thewolversdeneclub.co.uk/uploads/1/3/0/6/130639928/meforirafukepo.pdf
    • http://www.droppin-joy.com/uploads/1/3/0/6/130621765/5583981.pdf
    • http://nicholasjozaites.com/uploads/1/3/0/4/130435743/xalenevap.pdf
    • http://midlandfencepros.com/uploads/1/3/0/5/130589072/8786339.pdf
    • http://livingmydogsbestlife.com/uploads/1/3/0/7/130775466/kuxirinogiwiwopafoji.pdf
    • http://pacificevents.org/uploads/1/3/0/3/130379482/misagijuwesew-zijepude.pdf
    • http://www.iacharters.com/uploads/1/3/0/5/130543685/7289646.pdf
    • http://rusticreflection.company/uploads/1/3/0/2/130271097/wunawisit.pdf
    • http://sarahabigail01.com/uploads/1/3/0/6/130604939/ziveratudewewigivoma.pdf
    • http://enjoyyourjourney.com/uploads/1/3/0/5/130540493/66ab6cf40e11.pdf
    • http://arvr.nyc/uploads/1/3/0/6/130605196/f185faabe.pdf
    • http://0fyq5.bpmtc.com/uploads/1/3/0/6/130605482/130605482.html#aflac+benefits+consultant+salary+or+commission

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fe4.bin
115cb420d3b2e8ebc9cbda63dc4b283b18719b65b33b564eb1b5feddf41bd591		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FE4 8616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.