Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbf3037e05b8a3dd…

MALICIOUS

PDF

36.8 KB Authoring application: Soda PDF
MD5: 531406b41bdec2f99b6908d8880d1b0a SHA-1: 661f75ded57b351f0b407562534494bd31f8cd7d SHA-256: cbf3037e05b8a3dd30381c8ec076cbfe488e4b372cba5bb293fe7d47b92b5517
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rethinkingtheofficeevent.com/uploads/1/3/0/6/130604405/gawufe.pdf
    • http://mta-sts.mx.languagesfunandeasy.com/uploads/1/3/0/6/130620902/dotumen.pdf
    • http://almansweide.nl/uploads/1/3/0/6/130640155/lozaja_sijojopuvesasig_muperoxeburek_mogodujobusuzan.pdf
    • http://www.tierreclima.com/uploads/1/3/0/6/130620902/6922121.pdf
    • http://el043.elrepco.com/uploads/1/3/0/2/130270971/9ce7b325e.pdf
    • http://mirandapueyo.com/uploads/1/3/0/2/130287893/7638259.pdf
    • http://www.myeoschoolhouse.com/uploads/1/3/0/2/130291545/kozalegubivajiv-govasafaxe-xafenufijufej-gebite.pdf
    • http://eaglehealthinsurance.com/uploads/1/3/0/7/130776619/lotumuji.pdf
    • http://soniahidalgoeventos.com/uploads/1/3/0/8/130874042/gibugelijawide.pdf
    • http://thefabricmermaid.com/uploads/1/3/0/3/130313673/c665d.pdf
    • http://hostmaster.dentallabor-in-bonn.de/uploads/1/3/0/7/130739646/jorajavex_vetofapovije.pdf
    • http://www.churchconstructionintercessors.org/uploads/1/3/0/7/130740338/jakixexe.pdf
    • http://www.thrivecommunitycare.co.uk/uploads/1/3/0/6/130620731/dofoxawugifetep.pdf
    • http://northpacifictrainingperformanceinc.com/uploads/1/3/0/7/130740060/3372726.pdf
    • http://nowator.eu/uploads/1/3/0/5/130545434/130545434.html#cigna+prior+authorization+form+for+cimzia

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034d3.bin
ae1baa8db08388fab2808508cee0913dbe3803e79086c3a93801840719836453		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34D3 8220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.