PDF malware analysis — malicious · d8fb4a0c16661b2b

MALICIOUS

PDF

43.7 KB Authoring application: Poppler-utils

MD5: 8938fdb737454eaad9a8a7f26479f700 SHA-1: f6bd34566bc755f2ff4cca6c2d8d7b3ebd36935f SHA-256: d8fb4a0c16661b2b64534141b65b551cdd25ade6f90bc3c44b4a7bf9354a4edc

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document exhibits characteristics of a phishing or SEO spam campaign, as indicated by the critical heuristic 'PDF_SEO_LINK_FARM' which detected a mass of external links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The embedded URLs are likely used to host further malicious content or redirect users to phishing sites.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://billionsstreet.store/uploads/1/3/0/6/130603847/30dd89a61d4.pdf
- http://apocalypse.shop/uploads/1/3/0/6/130621944/1902f0599.pdf
- http://lakecountyrecovers.org/uploads/1/3/0/5/130540040/27212c3287.pdf
- http://mgmalehair.com/uploads/1/3/0/5/130589174/vonefoka.pdf
- http://www.pacificcircleconsortium.com/uploads/1/3/0/7/130740371/wefepadopi-tijowososojafo-redupaxukonasa.pdf
- http://www.lubbockinspections.com/uploads/1/3/0/6/130603929/gupepanerum_zixevutefi_mivasegidixidu_dokesutije.pdf
- http://yogavadhuta.com/uploads/1/3/0/6/130621490/3408792.pdf
- http://nelslehtinen.com/uploads/1/3/0/2/130287482/272394.pdf
- http://www.floorexpertslimited.com/uploads/1/3/0/2/130291575/bebomataxejo.pdf
- http://totahr.com/uploads/1/3/0/5/130590435/8067489.pdf
- http://stefanoseleftheriou.com/uploads/1/3/0/7/130739265/e109418c13.pdf
- http://shotbyraquel.com/uploads/1/3/0/3/130379363/ab9c9.pdf
- http://performanceatplay.com/uploads/1/3/0/3/130379181/6423193e.pdf
- http://www.new.westside-church.com/uploads/1/3/0/5/130543402/gobowerabadi.pdf
- http://tiersandcupcakes.com/uploads/1/3/0/6/130639744/gimiluzajiro-vidaw.pdf
- http://alwalsh-threeflightsup.com/uploads/1/3/0/4/130483338/vimikadisugojef-pugedu-devenozusojine.pdf
- http://tripvector.org/uploads/1/3/0/5/130540725/f2ed517f7e369.pdf
- http://dejavucollectorcars.com/uploads/1/3/0/5/130590278/994927441fd17.pdf
- http://openhandsrecovery.org/uploads/1/3/0/7/130775654/7684760.pdf
- http://www.takcapitalandconsulting.com/uploads/1/3/0/7/130740046/renowolipoz.pdf
- http://titosfiestamexicana.com/uploads/1/3/0/6/130622049/dalazekuridaralix.pdf
- http://amredco.com/uploads/1/3/0/5/130539888/nifasizosezulis.pdf
- http://willowdalecrane.com/uploads/1/3/0/4/130436337/tosudodeforeve.pdf
- http://shannonmarieryan.com/uploads/1/3/0/6/130604136/bulutajazixofuta.pdf
- http://a1975851xstreamtravel.xsideas.com/uploads/1/3/0/4/130477039/130477039.html#cover+letter+examples+for+customer+service+administrator
- http://stefanoseleftheriou.com/uploads/1/3/0/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002f2e.bin` `779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2F2E	16036 bytes
`font_01_sfnt_off00004654.bin` `8b5536f53c8dea3ce26bd1215407e5032c5ab235374db6a2fd716c0139b8ba09`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4654	8168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.