Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6fb678454164a4b…

MALICIOUS

PDF

42.0 KB Authoring application: Soda PDF
MD5: de380c775e1cb0690a22401592ba67df SHA-1: 23b1ee6b6f30eea554c7fee84814c28059fe88d3 SHA-256: c6fb678454164a4b82d644f03a35ddede732122a4d475d47f6d6bb7fee0041d2
130 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to other PDF files, indicating a link farm or a distribution mechanism for further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or malicious download campaign. The presence of a 'SE_DOWNLOAD_BUTTON' heuristic further supports the lure-based attack pattern.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.brianpatrickwilliams.com/uploads/1/3/0/3/130313358/vowekalajofexil-lilavitigesobem.pdf
    • http://smokersskincare.com/uploads/1/3/0/6/130604788/biwubedojaxa.pdf
    • http://advbiocomp.org/uploads/1/3/0/4/130435598/lulukosenumak-jalosugitibab.pdf
    • http://nagelstudio-bogenhausen.de/uploads/1/3/0/4/130488429/xagigexizuwirini.pdf
    • http://oakmountainfirewood.com/uploads/1/3/0/2/130272369/donusefo.pdf
    • http://neverweatherband.com/uploads/1/3/0/8/130874308/nukigerule.pdf
    • http://ninemilepasta.com/uploads/1/3/0/7/130739525/lawaluxizifow.pdf
    • http://morjanaspain.com/uploads/1/3/0/5/130551064/lipen.pdf
    • http://homehotel.net/uploads/1/3/0/7/130776174/sepofo.pdf
    • http://rivertonselfstorage.com/uploads/1/3/0/4/130475909/sikugesolezesibizika.pdf
    • http://talknique.com/uploads/1/3/0/6/130621815/4068056.pdf
    • http://immovera.net/uploads/1/3/0/2/130287211/4293513.pdf
    • http://www.aznursingresources.com/uploads/1/3/0/3/130313090/7044e39fc.pdf
    • http://denverlawreview.club/uploads/1/3/0/5/130550983/dcc221.pdf
    • http://www.oneclick.mirincondemoda.com/uploads/1/3/0/8/130814713/tepadimuje_memek_desojap.pdf
    • http://www.opusxgroup.com/uploads/1/3/0/2/130287894/3134747.pdf
    • http://fleettrackandfield.com/uploads/1/3/0/6/130640003/22b2e0f81.pdf
    • http://myssample.com/uploads/1/3/0/5/130539033/81af69114.pdf
    • http://scott-moe.com/uploads/1/3/0/7/130775795/kejejuzu.pdf
    • http://zrw.heathermcclarriephotography.com/uploads/1/3/0/5/130538859/3240fd.pdf
    • http://www.viewsxvibes.com/uploads/1/3/0/5/130546434/kurosidezupexow.pdf
    • http://envisione.services/uploads/1/3/0/8/130813779/130813779.html#oxford+handbook+of+clinical+examination+and+practical+skills+2nd+edition+pdf+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003845.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3845 1708 bytes
font_01_sfnt_off0000434b.bin
54e47cefdee231f00b6225f8a15fb4f89bc5160bc707428acd5b25016e08f5e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x434B 7904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.