Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2fead9f1406586e…

MALICIOUS

PDF

72.7 KB Authoring application: Inkscape
MD5: 6e5a094653b636cc19036fd0c520a584 SHA-1: d01010feaf797874f91014de3115432e8cb1bac6 SHA-256: c2fead9f1406586eee01fcf9f5c5de1be6ddeb13164f76df75558c81d0b93def
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links to other PDFs, indicating a link farm designed to distribute malicious content. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly suggests the document's purpose is to trick users with a fake prize or delivery notification, a common tactic in advance-fee fraud. The ClamAV detection further confirms its malicious nature. The embedded URLs are likely part of this distribution network.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amiguru-me.com/uploads/1/3/0/3/130313480/bupibafirogolukufif.pdf
    • http://blacivoryentertainment.com/uploads/1/3/0/5/130540559/4423532.pdf
    • http://scfiresprinkler.net/uploads/1/3/0/5/130543816/lewofu-jekisugeno-siwusi.pdf
    • http://dentistmanalapannj.com/uploads/1/3/0/7/130739561/2782687.pdf
    • http://www.barifine.com/uploads/1/3/0/3/130323884/durupegudapugajib.pdf
    • http://chippenhampositiveliving.com/uploads/1/3/0/5/130551245/2623984.pdf
    • http://nontraditionalstudent.space/uploads/1/3/0/4/130489434/paxerufiveboxafa.pdf
    • http://naturesblissjamaica.com/uploads/1/3/0/7/130739020/ed0c62c9575f3ea.pdf
    • http://alanmaps.com/uploads/1/3/0/7/130775456/tufofoninakuv.pdf
    • http://plumtreefloraldesign.com/uploads/1/3/0/7/130776341/157581.pdf
    • http://momosnaturals.com/uploads/1/3/0/6/130639419/madavorikojok.pdf
    • http://craftychicdawn.com/uploads/1/3/0/5/130541116/dazebojeku_xuguge_kaguwe_xixagefa.pdf
    • http://andrew-gustafson.com/uploads/1/3/0/3/130313090/dowenerirudud_tobezonogevisin_vadijikibu.pdf
    • http://www.theleedscatrescue.co.uk/uploads/1/3/0/8/130814508/66cecdf32db.pdf
    • http://www.greentreedelivery.co.uk/uploads/1/3/0/4/130488543/0001fcb94.pdf
    • http://pointsoffivetarot.com/uploads/1/3/0/5/130550796/947926.pdf
    • http://learninator.net/uploads/1/3/0/7/130739873/2466585.pdf
    • http://74-123-78-242.mgwnet.com/uploads/1/3/0/7/130774978/130774978.html#genetic+classification+of+acute+lymphoblastic+leukemia
    • http://andrew-g

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002a11.bin
4663845b9e09a92201cf451da4678bd0643e0bf03e4bd6d123271f1ad0152dea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A11 9948 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.