Malicious PDF — malware analysis report

Static analysis result for SHA-256 d19d48ab9d1a10fd…

MALICIOUS

PDF

37.8 KB Authoring application: QPDF
MD5: b251096e8de14ab21f9051f902536652 SHA-1: 97239344f9d6638a1f7440d07337a1af0414b9dd SHA-256: d19d48ab9d1a10fde562ec81574066ad96fcc8bdf1fafdbd1a88594bbba177cb
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDF files, indicating a link farm for SEO or malicious redirection. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious traffic generation intent. The presence of a 'Download Now' lure reinforces the deceptive nature of the document.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://melscripting.net/uploads/1/3/0/6/130620213/zejizavarevav-leforasot-zanij.pdf
    • http://oxfordnaa.com/uploads/1/3/0/5/130541351/2781972.pdf
    • http://puzzlesforprogress.com/uploads/1/3/0/4/130490786/027a903.pdf
    • http://sekedamedia.com/uploads/1/3/0/5/130588679/sepufubale-wipajix.pdf
    • http://mta-sts.icpetsit.com/uploads/1/3/0/7/130775103/1136353.pdf
    • http://autodiscover.tom.alifeexplored.com/uploads/1/3/0/5/130541641/durixokapefi-rumipip-fifotasobopub-vedeve.pdf
    • http://clinicalcampus.com/uploads/1/3/0/4/130476340/16cecfc.pdf
    • http://oaklandempowermentscholarshipprogram.com/uploads/1/3/0/6/130621995/f24ef0.pdf
    • http://alexjosephs.com/uploads/1/3/0/4/130488063/jiwiwese-ximusavu.pdf
    • http://lovegoddessamber.com/uploads/1/3/0/6/130621276/680fcfec6e.pdf
    • http://ministeringwithmegan.com/uploads/1/3/0/7/130738883/4284147.pdf
    • http://humbleinvesting.com/uploads/1/3/0/3/130313247/damebatofifogaxuzizu.pdf
    • http://blinebeachbar.com/uploads/1/3/0/4/130490602/jixirobokot.pdf
    • http://azurdeplacements.fr/uploads/1/3/0/6/130621555/2029107.pdf
    • http://keppingerlaw.com/uploads/1/3/0/6/130604646/199fd105ed726.pdf
    • http://karmatechnic.com/uploads/1/3/0/6/130605471/galugolofajidob.pdf
    • http://renovareinstitute.net/uploads/1/3/0/5/130542972/1607713.pdf
    • http://professionalassisting.com/uploads/1/3/0/3/130313480/tibazurabi_lesiwuvej_nexurovubo.pdf
    • http://prestomagictravel.voyagerwebsites.com/uploads/1/3/0/5/130589308/130589308.html#present+perfect+past+perfect+and+future+perfect+verb+tenses+worksheets
    • http://alexjosephs.com/uploads/1/3/0/4/130488063

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034d6.bin
ad016f455943bd13f444c8e37dbb2f704f3518f2dd0e2421211f39ff50d76afc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34D6 8164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.