Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd0a6b56c1c711e6…

MALICIOUS

PDF

40.2 KB Authoring application: Soda PDF
MD5: 684211faada505e3ba6b86c0c6f05f70 SHA-1: d4fcae9205612b970b0da87741ccb9739fd4621c SHA-256: bd0a6b56c1c711e656f21aa65414b86ffe46100b632e5464cefd3fe90fb033d1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which are likely used to redirect users to malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. The embedded URLs are structured in a way that suggests an attempt to manipulate search engine results or to distribute phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amorcocoa.com/uploads/1/3/0/2/130288682/4938280.pdf
    • http://johnathanpeterson.com/uploads/1/3/0/3/130312919/4294348.pdf
    • http://cgccc.com/uploads/1/3/0/6/130621083/1771843.pdf
    • http://affiliatedtattoofamily.com/uploads/1/3/0/2/130271137/lewur.pdf
    • http://radikosoft.com/uploads/1/3/0/7/130739223/vunafujos-kabowinibina-sasavipokeduso-fijolufinub.pdf
    • http://churchesinmilwaukee.com/uploads/1/3/0/5/130588779/wobididam.pdf
    • http://www.cgmhotshot.com/uploads/1/3/0/4/130435639/gomuzorazomu-xuwuwigupezej-tezesowiputagos-xuvejexuxa.pdf
    • http://rhema-africa.net/uploads/1/3/0/5/130550879/304e54.pdf
    • http://justchryssbeauty.com/uploads/1/3/0/5/130551258/cf0842742de2d.pdf
    • http://bayook.com/uploads/1/3/0/6/130639689/liroxujifik.pdf
    • http://nowtrainer.com/uploads/1/3/0/7/130739968/96f29bb6f.pdf
    • http://emulsina.com/uploads/1/3/0/8/130874338/fipatepa.pdf
    • http://centerforgovernmentleadership.org/uploads/1/3/0/2/130289211/marixuzenasusisaxoxe.pdf
    • http://trumpdisciple.org/uploads/1/3/0/6/130604222/8925336.pdf
    • http://thesongstress.com/uploads/1/3/0/7/130740012/141e08f.pdf
    • http://www.lawson-kilauea.com/uploads/1/3/0/6/130639947/xuxevozukak.pdf
    • http://metropolitaneprep.com/uploads/1/3/0/7/130739456/c0fc485d5470.pdf
    • http://k12districtsolutions.com/uploads/1/3/0/5/130544132/c1f24dc265bc.pdf
    • http://carolynsandstrom.com/uploads/1/3/0/3/130312925/potawabit.pdf
    • http://nutrixhealthcareltd.com/uploads/1/3/0/7/130739633/41a4356e64849d8.pdf
    • http://lubbockseniorphotographer.com/uploads/1/3/0/8/130813849/9203843.pdf
    • http://americorealestates.com/uploads/1/3/0/3/130323703/botosuf_dopezipaz_soxiwedizam_sufufuxijikusab.pdf
    • http://whats-the-tea.com/uploads/1/3/0/8/130814248/4805516.pdf
    • http://jimmyplease.com/uploads/1/3/0/7/130739185/jiwoxumebudekig.pdf
    • http://keelysbusybees.com/uploads/1/3/0/2/130274199/pemifoxujogidag-gadibubokif-weleputo-jifinavufa.pdf
    • http://uimnt.brdge.org/uploads/1/3/0/6/130639669/130639669.html#business+administration+job+description+pdf
    • http://trumpdisciple.org/uploa

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003958.bin
027e7dd46296ce09b4c6eeeb99879829abdc75f17b0ad43699d82a9faf51689e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3958 7556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.