Malicious PDF — malware analysis report

Static analysis result for SHA-256 d795e6f0e8e1ef08…

MALICIOUS

PDF

39.7 KB Authoring application: pdf-parser
MD5: 5b4e1e4f48a081bb9a6fc01909e654c7 SHA-1: 81117b7a178ca2019d537ecb49219e07fdd24d24 SHA-256: d795e6f0e8e1ef081737b0d7be15e5ee15fca966a052333fcfa8a9f96a2d3fd8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection also flags it as phishing-related. The embedded URLs likely lead to malicious content or phishing sites, aiming to trick users into downloading further malware or divulging sensitive information. The document body itself contains text related to binary to hexadecimal conversion, which may serve as a lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://consulatcotedivoire.com/uploads/1/3/0/6/130603948/8489682.pdf
    • http://lilyseidel.com/uploads/1/3/0/4/130489434/nikagokutava.pdf
    • http://catchermediatestsite.weebly.com/uploads/1/3/0/4/130476744/fa4ec445ca2d42.pdf
    • http://sigoaprendiendo.com/uploads/1/3/0/6/130605501/3491355.pdf
    • http://beingself-centered.com/uploads/1/3/0/3/130312961/130312961.html#como+convertir+de+binario+a+hexadecimal

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000108b.bin
c18571c6d52ed1da16c811d639d019d6d42075f16d03f4f0d209579501cac664		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108B 9328 bytes
font_01_sfnt_off0000603e.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x603E 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.