Malicious PDF — malware analysis report

Static analysis result for SHA-256 c477a05b8906a91e…

MALICIOUS

PDF

42.3 KB Authoring application: GIMP
MD5: 8ece018cbbe6a711ac265aa2cfb722f0 SHA-1: 70abd78220f59697ebbb8a88d866ddf17f4686ce SHA-256: c477a05b8906a91e362ab31a3c451b84bafb91f153607202f517920179f81d3b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body itself is heavily obfuscated and does not provide clear user-facing text, but the heuristic firings strongly point towards a malicious intent related to link distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://embracinglifeconsulting.com/uploads/1/3/0/4/130488666/8c7af70c0d.pdf
    • http://eliyahmusic.com/uploads/1/3/0/3/130379353/visad.pdf
    • http://theparksphysie.com/uploads/1/3/0/8/130813054/xiwekumuruwa-rivofametipidu.pdf
    • http://fartlyfe.com/uploads/1/3/0/6/130639462/lejomid.pdf
    • http://xn--c1aanafncj4aa9da2gcbc.xn--l1acc/uploads/1/3/0/6/130621110/puvef-fetevajipizobax-vuxen.pdf
    • http://www.eslmyway.com/uploads/1/3/0/7/130776130/01b8a932f2c.pdf
    • http://integr8vitality.com/uploads/1/3/0/2/130289332/dovodemebad.pdf
    • http://www.sv-officefurniture.com/uploads/1/3/0/2/130287538/6523682.pdf
    • http://coolerbtl.org/uploads/1/3/0/3/130379597/mufuwemu.pdf
    • http://mta-sts.mx.murphyfamilyelectric.com/uploads/1/3/0/7/130776719/7738504.pdf
    • http://nagsthlm.com/uploads/1/3/0/7/130738623/gukilukugemirodanim.pdf
    • http://diracommunity.com/uploads/1/3/0/5/130588543/9cfa4cc3583.pdf
    • http://mta-sts.mx.spokanechiefsboosterclub.org/uploads/1/3/0/5/130544754/21380.pdf
    • http://lamoradabnb.com/uploads/1/3/0/4/130488199/130488199.html#mitosis+and+meiosis+questions+and+answers+pdf
    • http://www.eslmyway.com/uploads/1/3/0/7/130776130/01b8a932f2c.pd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048ea.bin
eeec853a782c86929bf2a4ba00541d7f96ae2ff65cbc334857bd83bce88eb157		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48EA 9332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.