Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7b83cf8190d6b4e…

MALICIOUS

PDF

47.0 KB Authoring application: ImageMagick
MD5: 5304ce2e302c1ba60c4a7b56bcd32540 SHA-1: a01aa406a3e7b501056f881894968adc8477d391 SHA-256: d7b83cf8190d6b4eb9fe7f41cc2d065788d8f9494bb4dc3c76c84f3bda00a612
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, many of which point to other PDF files, indicating a link farm designed for SEO manipulation. The document body presents a deceptive download prompt for a software converter, which is a common lure for phishing or malware distribution. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.getalyftbonus.com/uploads/1/3/0/6/130604812/wiwivafajum.pdf
    • http://prospernola.com/uploads/1/3/0/8/130814237/jasinor.pdf
    • http://blueegg.net/uploads/1/3/0/5/130588531/7365150.pdf
    • http://mieldercarelaw.com/uploads/1/3/0/8/130874133/23bbb3a7ff5.pdf
    • http://cecilyeiferle.com/uploads/1/3/0/5/130543289/ebda113.pdf
    • http://andaveycrea.com/uploads/1/3/0/5/130551876/gufula.pdf
    • http://www.ayrical.com/uploads/1/3/0/2/130272573/7528928.pdf
    • http://mhi-hoa.com/uploads/1/3/0/6/130621190/jozofebe.pdf
    • http://2recommend.online/uploads/1/3/0/6/130639668/10af4119e.pdf
    • http://nissanpatrolparts.com/uploads/1/3/0/6/130639476/75a4a41090f.pdf
    • http://theloveboxcompanyonline.com/uploads/1/3/0/4/130489742/mixunasomudikofozeze.pdf
    • http://clinicaespacosaudebeleza.net/uploads/1/3/0/3/130323523/riduzob.pdf
    • http://norfolkeyephysiciansandsurgeons.com/uploads/1/3/0/8/130814416/nelotu.pdf
    • http://cisledhockey.com/uploads/1/3/0/2/130271046/ruzedam-tawot.pdf
    • http://catswearitsat.com/uploads/1/3/0/8/130814462/sotumoza.pdf
    • http://teatottalers.com/uploads/1/3/0/8/130814843/megibikaroduve_rosas_dowadexot.pdf
    • http://kwhitewc.com/uploads/1/3/0/2/130272979/wefitivebej.pdf
    • http://hardcoretires.com/uploads/1/3/0/6/130621867/nogup-midiradurobagif-bejixizil.pdf
    • http://toldoshorta.com/uploads/1/3/0/7/130738933/e82c8c11.pdf
    • http://apacint.com.au/uploads/1/3/0/8/130814516/runuxakafituga.pdf
    • http://artbookblog.org/uploads/1/3/0/8/130873794/muwifu_rokof_kaluwuturu.pdf
    • http://onlygodcanjudgeus.com/uploads/1/3/0/6/130605030/denovidato.pdf
    • http://miguelvaldiviezo.com/uploads/1/3/0/4/130491757/wupuraxurasujoguwez.pdf
    • http://www.injury2019.nz/uploads/1/3/0/7/130739682/webiteruk.pdf
    • http://huanqiuyulechengzhuye.br3h.com/uploads/1/3/0/9/130969262/130969262.html#english+to+hindi+converter+free+download+for+windows+7
    • http://clinicaespacosaudebeleza.net/uplo

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003870.bin
d80f3d2cca52603524a074d611e27e3cb762a037ced4da2fd2b64e833ef7590e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3870 9348 bytes
font_01_sfnt_off00005419.bin
cc24ac0dbd5505d8d8dfef1a423f1cdc3106bf5e699acad6b3660f251a4b32e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5419 8072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.