Malicious PDF — malware analysis report

Static analysis result for SHA-256 c103d4170f82519c…

MALICIOUS

PDF

39.7 KB Authoring application: GIMP
MD5: 7997c6e64abd2bf5584c8f55b4146c72 SHA-1: 09217657a4068c138dd8976436d890ff8457b51a SHA-256: c103d4170f82519c7070ba3e2fbd053466335f902f22516148145c628791e700
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of embedded external links, a technique commonly used for SEO poisoning or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body contains garbled text and a reference to 'Netflix earnings report whisper', suggesting a lure to financial information or scams.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://padorose.weebly.com/uploads/1/3/0/6/130604859/bd18b.pdf
    • http://palmsrealty.org/uploads/1/3/0/6/130620704/72c519.pdf
    • http://thatyoumaybelieve.com/uploads/1/3/0/6/130640105/332bfc646758e3.pdf
    • http://castellanoart.net/uploads/1/3/0/4/130488604/vidimapimutisax.pdf
    • http://realmotivated.com/uploads/1/3/0/6/130605071/4820316.pdf
    • http://michalpaczkowski.com/uploads/1/3/0/4/130436125/walewotibesij.pdf
    • http://opusjobs.net/uploads/1/3/0/4/130483542/xatenuwezov-koratokana-bipumupusamut.pdf
    • http://adancerstouch.com/uploads/1/3/0/4/130476502/40bb8fdc30fbb.pdf
    • http://vabolej.powking1.ru/uploads/2020/01/28/162e900da7c.pdf
    • http://espaces.cz/uploads/1/3/0/6/130639607/rusisufawipuposax.pdf
    • http://tomryan.com.au/uploads/1/3/0/3/130313173/4dffee8c.pdf
    • http://baanekspres1995.com/uploads/1/3/0/5/130551021/pivojasu.pdf
    • http://rockvilleintegrativetherapist.com/uploads/1/3/0/5/130590756/34700fd7ce.pdf
    • http://adamhilto900eportfolio.com/uploads/1/3/0/5/130589150/wimewazisesa-tureke.pdf
    • http://canadian-photography.ca/uploads/1/3/0/2/130271250/bc8210.pdf
    • http://kevinmenck.com/uploads/1/3/0/6/130620694/aa101b02b8df46.pdf
    • http://mountvernonparking.com/uploads/1/3/0/6/130620407/tosesi-motagamenobemu-serifinovew-nugexabuj.pdf
    • http://mygraphicdesignteam.com/uploads/1/3/0/6/130604935/b969be4df.pdf
    • http://christine-carney.com/uploads/1/3/0/5/130590368/sarudal.pdf
    • http://performx.shop/uploads/1/3/0/2/130270777/1175444.pdf
    • http://7magicflower.com/uploads/1/3/0/4/130477245/muxibovifu_runukebawonefep.pdf
    • http://chloeskidmore.com/uploads/1/3/0/4/130435582/8878509.pdf
    • http://kudbehar.com/uploads/2020/01/28/najalunovilux.pdf
    • http://kabowuj.tuhuellatepertenece.com/uploads/2020/01/28/jepaxepelijo.pdf
    • http://business.berkeleychamber.com/uploads/1/3/0/6/130621290/ea6e3656d8b21e.pdf
    • http://trentriverdesigns.com/uploads/1/3/0/4/130490561/130490561.html#netflix+earnings+report+whisper
    • http://chloeskidmore.com/uploads/1/3/0/4/1304355

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017c7.bin
1371982668327cabf09514cfd56ef70af4b982ea62cae0f208ced1a19d438a90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17C7 8504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.