Malicious PDF — malware analysis report

Static analysis result for SHA-256 c06e5a02cf235319…

MALICIOUS

PDF

50.7 KB Authoring application: QPDF
MD5: 724334c23854057cf6702c55b39eb28b SHA-1: 2b955300d8a69846c8529a3f512d84127b2a0e15 SHA-256: c06e5a02cf23531954e1d4cf7c4dae84b313f226fad5ab4b874fde8499daf012
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm designed to distribute malicious content or conduct phishing campaigns. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bbirrigationlandscape.com/uploads/1/3/0/6/130621277/xipupolarokug_fifixoriz_vadezolapotegi_pofigunikowafav.pdf
    • http://patriciajaggie.com/uploads/1/3/0/7/130775431/25309d0ccc4.pdf
    • http://coffeeatyouroffice.com/uploads/1/3/0/6/130621732/fowalejufo.pdf
    • http://credit-karma.co/uploads/1/3/0/4/130476912/suvubakug.pdf
    • http://arizonacustomgraphics.com/uploads/1/3/0/5/130543318/4729598.pdf
    • http://978weddings.com/uploads/1/3/0/8/130813652/xuwoxumopupu_pufusedo.pdf
    • http://supremenormal.com/uploads/1/3/0/6/130604910/vokixupisapo.pdf
    • http://innergameofapproach.com/uploads/1/3/0/7/130775854/9313070.pdf
    • http://bandstore.net/uploads/1/3/0/2/130272945/xafuwubuz.pdf
    • http://www.turnheadcarwrap.com/uploads/1/3/0/5/130588370/dinalu-ravel.pdf
    • http://franksayssit.co.uk/uploads/1/3/0/5/130550982/ae0cfbcbe4.pdf
    • http://icandecidemaryland.com/uploads/1/3/0/7/130739751/09c01b0b.pdf
    • http://myptresource.com/uploads/1/3/0/8/130813982/jajuxij.pdf
    • http://myowild.net/uploads/1/3/0/5/130589040/8bf36d5.pdf
    • http://mobilpapershredding.com/uploads/1/3/0/2/130272360/338d3270e3c27b.pdf
    • http://stevenhollman.com/uploads/1/3/0/7/130775573/libeweruxojil-vopuzabafu.pdf
    • http://yolozwolle-lekkerpuh.nl/uploads/1/3/0/4/130476120/5173673.pdf
    • http://www.phaemacmin.com/uploads/1/3/0/8/130814178/pijeg_dagemepidula_kenejiladuge_xufupemo.pdf
    • http://pinweiwong.com/uploads/1/3/0/3/130379634/6232321.pdf
    • http://www.michaelballarddesigns.com/uploads/1/3/0/8/130814534/a9015bb8.pdf
    • http://falconinvestigates.com/uploads/1/3/0/3/130323515/6211c.pdf
    • http://tobler-design.ch/uploads/1/3/0/7/130739662/7ca3a896c8a7b.pdf
    • http://thestickermill.com/uploads/1/3/0/5/130590443/fonosu-zetabugad-datijosa-jogamifoxujo.pdf
    • http://webmail.collegedemsatiu.com/uploads/1/3/0/5/130550938/130550938.html#heart+failure+-+symptoms+and+causes+-+mayo+clinic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fd2.bin
7f2d87777c40f961ecdf8703fe8352687e16b0b31f59728ee6a748b6163032e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD2 8696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.