Malicious PDF — malware analysis report

Static analysis result for SHA-256 caadc8bee3352e9a…

MALICIOUS

PDF

41.8 KB Authoring application: PDFBox
MD5: 6ec84b05d629f7afad3fa8d1fc2cbf71 SHA-1: 6a00ac072c5f7e4f06820b1a13fb6df247080b05 SHA-256: caadc8bee3352e9a719728d77853121461fecae92b319c215f0a9ee1a1bd3ad7
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a link farm pointing to multiple external PDF files, a common tactic for SEO poisoning and phishing. The document body text, though partially obfuscated, mentions 'Core java books for beginners pdf' as a lure. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' further indicates a scam, likely to trick users into downloading malicious content. The embedded URLs are the primary IOCs, directing users to potentially malicious PDFs.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muscatmassage-service.com/uploads/1/3/0/5/130543546/dakifezedodezikok.pdf
    • http://lilscholarstoo.com/uploads/1/3/0/4/130436108/6688565.pdf
    • http://christianawt.com/uploads/1/3/0/5/130539936/7885039.pdf
    • http://truedefinitionlab.com/uploads/1/3/0/7/130739655/0c171.pdf
    • http://stylebyquilo.com/uploads/1/3/0/6/130620712/wosipovevolowe.pdf
    • http://ellipseatlantic.com/uploads/1/3/0/2/130272415/1062448.pdf
    • http://rek.se/uploads/1/3/0/6/130604742/3059260.pdf
    • http://specblend.com/uploads/1/3/0/6/130620575/7365775.pdf
    • http://nursingarmpillow.com/uploads/1/3/0/5/130551391/130551391.html#core+java+books+for+beginners+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011c9.bin
438f18da4bb7f2d8e3552ac8ed4026e57bff80640fd44729693a4413e0868622		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C9 9480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.