Malicious PDF — malware analysis report

Static analysis result for SHA-256 c07f61978da62938…

MALICIOUS

PDF

38.9 KB Authoring application: Adobe PDF Library 9.0
MD5: 68a3bf98f84f070600619df21e2ca69e SHA-1: 795f503e05270d3a46bc0640b72ce48588bfe48c SHA-256: c07f61978da629384bce31d04842f55f1b08109a11ef4f92185827a2e110ded6
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files hosted on various domains. This technique is commonly used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ri4d.com/uploads/1/3/0/5/130588948/9880016.pdf
    • http://e-performancetahiti.com/uploads/1/3/0/4/130490451/lubituxibulawef.pdf
    • http://drmanivongjratts.com/uploads/1/3/0/5/130588685/8448596.pdf
    • http://southfloridamapping.com/uploads/1/3/0/5/130542964/5527729.pdf
    • http://waveswaterfront.com/uploads/1/3/0/5/130550828/pezazep.pdf
    • http://modtran8.net/uploads/1/3/0/3/130323401/4909425.pdf
    • http://bigmindbigsoul.com/uploads/1/3/0/6/130620955/wolonuw.pdf
    • http://www.julesmagickmoon.com/uploads/1/3/0/2/130289096/20b9df1371b5.pdf
    • http://startagreatfuture.com/uploads/1/3/0/6/130603882/nivolagewonokadumaz.pdf
    • http://moneymatchgaming.com/uploads/1/3/0/5/130543996/vojuvonakobid_divoxuvav.pdf
    • http://www.archivistar.com/uploads/1/3/0/2/130274024/birinasawonawaf_xowajipero_nipefobepu.pdf
    • http://asksparrow.services/uploads/1/3/0/5/130544625/2099680.pdf
    • http://dinosdelosmuertos.com/uploads/1/3/0/6/130620934/tosinujena_mabiravaxos.pdf
    • http://catchnrelease.org/uploads/1/3/0/3/130323337/molikagisarerokexo.pdf
    • http://koppsinmalawi.com/uploads/1/3/0/6/130639306/2469641.pdf
    • http://dogzandcoffee.com/uploads/1/3/0/2/130287548/rejofe.pdf
    • http://74-123-73-112.mgwnet.com/uploads/1/3/0/3/130379435/130379435.html#tipos+de+anemia+hemol%C3%ADtica+autoinmune

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003cce.bin
bee605476db0014152b2fa5686b7e3302cd41b396ede7716ecdbd2a8e9ea6409		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CCE 8432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.