Malicious PDF — malware analysis report

Static analysis result for SHA-256 d43213bd3d37749d…

MALICIOUS

PDF

44.4 KB Authoring application: Solid Converter PDF
MD5: 6998d35f70f5aa6577645b78d19d7ca6 SHA-1: aa6efea15db165195bb55caef0f8ebf8c8802b93 SHA-256: d43213bd3d37749d31079d98e1219a06eb5e36b60f437601f6b49df530eb8ba6
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body is heavily obfuscated and does not provide clear textual lures.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gameflu.co/uploads/1/3/0/4/130488955/7259496.pdf
    • http://backsplashhome.com/uploads/1/3/0/6/130639762/1ab7eac.pdf
    • http://briannedempsey.com/uploads/1/3/0/8/130874077/8731156.pdf
    • http://ubaentertainment.com/uploads/1/3/0/7/130776041/xitunafe_kasutun_wevuwutijeras.pdf
    • http://ns2.alleghenycleanways.org/uploads/1/3/0/2/130270945/gizefapituze.pdf
    • http://www.moneyforpropertydamage.com/uploads/1/3/0/4/130476340/760e3.pdf
    • http://kris-ginadesigns.com/uploads/1/3/0/6/130604769/71948de7835c.pdf
    • http://mondesubtil.com/uploads/1/3/0/2/130291463/e44c3adef.pdf
    • http://kontrabecki.info/uploads/1/3/0/5/130551129/miwopovupimakegejir.pdf
    • http://mydetailguyinc.com/uploads/1/3/0/3/130379063/a1f84.pdf
    • http://ahotel.life/uploads/1/3/0/6/130621741/9798000.pdf
    • http://koinlando.com/uploads/1/3/0/7/130739656/xuxagajaxezobo-rodesitawab-wiweketavip.pdf
    • http://steveburrowsmusic.com/uploads/1/3/0/3/130313212/1169337.pdf
    • http://nwm4.club/uploads/1/3/0/6/130639903/rukilotuw.pdf
    • http://ertechnologyict.com/uploads/1/3/0/5/130589354/821913.pdf
    • http://esemkb.com/uploads/1/3/0/6/130639230/fezoxojadotexi-tulemijepaneg.pdf
    • http://oaklandcommunitycouncil.org/uploads/1/3/0/5/130550750/vikasozakojema.pdf
    • http://jessicalgervaisbooks.com/uploads/1/3/0/2/130292098/130292098.html#passive+modals+quiz
    • http://briannedempsey.com/uploads/1/3/0/8/1

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003adc.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3ADC 16036 bytes
font_01_sfnt_off00005201.bin
ca69ec793900c80bf42d944c86978b51418ad139ce8d6ae742896fd978326ea8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5201 7720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.