Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1aab7bf8722e3ff…

MALICIOUS

PDF

37.6 KB Authoring application: GIMP
MD5: 677d45cbef468cf5da6664fa0d2ca80d SHA-1: 4ae68a965a132cba0f4fd3827bdbf30b47157759 SHA-256: d1aab7bf8722e3ff430cfe15c2bd7485d960e80b8a83a5836093545b509703c4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits a critical heuristic firing for a 'SEO LINK FARM', indicating a large number of external links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely phishing or malware distribution. The embedded URLs are consistent with this pattern, aiming to redirect users to potentially harmful content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://recordingstudiospokane.com/uploads/1/3/0/4/130435813/jipafura.pdf
    • http://millworksguernsey.com/uploads/1/3/0/6/130604025/kekezasajuw-wezis-sanimuwugor.pdf
    • http://www.thequeensofheart.love/uploads/1/3/0/8/130874529/d8d4f35ee95.pdf
    • http://fotoprofissional.com/uploads/1/3/0/7/130775205/a7299fb130.pdf
    • http://easystc.com/uploads/1/3/0/4/130476024/neforavipix-fizosu.pdf
    • http://ttmr8.org/uploads/1/3/0/5/130546283/8446805.pdf
    • http://rivalrygraphics.com/uploads/1/3/0/2/130289461/8c6eabfee321792.pdf
    • http://gvk4nm.com/uploads/1/3/0/3/130379548/dasifaj.pdf
    • http://americasmostwasted.com/uploads/1/3/0/6/130604448/2320325.pdf
    • http://agapechaplain.com/uploads/1/3/0/5/130546434/1062054.pdf
    • http://kupetspinkinvitational.com/uploads/1/3/0/7/130739175/pogaj.pdf
    • http://smartpromoting.com/uploads/1/3/0/3/130323894/9752d.pdf
    • http://fdnyfootball.com/uploads/1/3/0/6/130621544/vivowope.pdf
    • http://trueelegancetransportation.com/uploads/1/3/0/5/130540869/d94f11c1cd7b6a.pdf
    • http://cloud.sentinel-air.com/uploads/1/3/0/6/130620986/130620986.html#cigna+healthspring+prior+authorization+form+hep+c
    • http://rivalrygraphics

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000378f.bin
5d45862f02e7a76280c705a49e1b6043b56b40d5a0748a8dcdad232d3ccd1931		 pdf-font-stream PDF embedded font (sfnt) at offset 0x378F 8500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.