Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc498ef37af0f31c…

MALICIOUS

PDF

52.1 KB Authoring application: Smallpdf Desktop
MD5: 57b0fa88c09cf0c3fa64c714d0cae2fb SHA-1: 3df8e2d13b9e78145748f4ca5b94236784f92663 SHA-256: cc498ef37af0f31c3fc50f33d6032ed666d4b9a9ab71be2b415098c868ac4e0c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV with the signature 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a significant number of embedded external links, identified by the 'PDF_SEO_LINK_FARM' heuristic. The primary URL identified is http://naturalbalancetherapies.org/uploads/1/3/0/5/130548039/3009342.pdf. This suggests the document is designed to redirect users to potentially malicious or phishing-related content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://naturalbalancetherapies.org/uploads/1/3/0/5/130548039/3009342.pdf
    • https://roxarotoxekod.weebly.com/uploads/1/3/0/4/130475966/memebekosivirigupa.pdf
    • http://insecureexchange.net/uploads/1/3/0/4/130478470/2795026.pdf
    • http://ndbc-shanghai.com/uploads/1/3/0/5/130539309/b090f5b35e0c9b.pdf
    • http://amicoffeecompany.com/uploads/1/3/0/6/130605179/vajemidipin.pdf
    • http://ya-amar.com/uploads/1/3/0/6/130621003/ebffa71eb.pdf
    • http://shaakirasharifeducationalpsychologyandtechnologyprogram.com/uploads/1/3/0/6/130621502/nezovuzakur-newak.pdf
    • http://us.momotombochocolatefactory.com/uploads/1/3/0/7/130738943/130738943.html#ubuntu+16.+04.+5+lts

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000116a.bin
d8f22a3226d49facbcf1a0271336e3a947bd62064395e185d2938bfb3563a034		 pdf-font-stream PDF embedded font (sfnt) at offset 0x116A 8252 bytes
font_01_sfnt_off00006f05.bin
88123258e6e111adc77ed43c080c33a1f207c26bc73aebc4e6f67255c6a3754a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F05 14256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.