Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0f2c6932f51a2af…

MALICIOUS

PDF

36.4 KB Authoring application: GIMP
MD5: 4f88c14ed40e94bdca96ec93bf19ee6f SHA-1: b8424acce18922cb78ae896453c6da4823941458 SHA-256: c0f2c6932f51a2af1f6bff4fa753dc6ab78e2ab59021f3008e3a2f6d57857bf4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious payloads. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.architecturalshowerdoordesigns.com/uploads/1/3/0/6/130604947/8d92ad766d.pdf
    • http://christianrmcdaniel.com/uploads/1/3/0/2/130271004/1188436.pdf
    • http://cma458.com/uploads/1/3/0/7/130775045/a76e7f21402.pdf
    • http://purrfectpurr.com/uploads/1/3/0/7/130738779/949e24026.pdf
    • http://wendoverconsultants.com/uploads/1/3/0/2/130273804/a36dbe1.pdf
    • http://adoptedbyjets.com/uploads/1/3/0/5/130543364/gunin.pdf
    • http://bonermaterial.com/uploads/1/3/0/6/130604022/nimuxudevotofofujet.pdf
    • http://whitehatsandassociates.com/uploads/1/3/0/8/130813033/444ae48408bd.pdf
    • http://ella-joy.com/uploads/1/3/0/7/130740068/ec0b9775d0e157a.pdf
    • http://valedetoxclinic.com/uploads/1/3/0/7/130739936/253591ead2506.pdf
    • http://pbconsulting.us/uploads/1/3/0/7/130775288/sawitudatoruni.pdf
    • http://ashtoninsuranceagents.com/uploads/1/3/0/2/130289185/lufetuwamixux_namudotarebel_gemenapa.pdf
    • http://hwangchris.com/uploads/1/3/0/7/130776519/46343.pdf
    • http://host133.carmichaelnl.com/uploads/1/3/0/9/130969150/130969150.html#second+conditional+board+game+teach+this
    • http://cma458.com/u

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003652.bin
159dda2a9393c1a347f4bcea58dd2078b60c196117fb58a4f0f11cef95cb3006		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3652 7516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.