Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9358e346f5306f2…

MALICIOUS

PDF

36.5 KB Authoring application: Smallpdf Desktop
MD5: 608304ce13ced6d06cc31ec4cb7b5ca9 SHA-1: cdb02ea3515e6f44e417158dc4eed6d92c3b9890 SHA-256: d9358e346f5306f2bda76c7e7be8d8a409dfb426dcd250c0bd35bb2bc4d3d8e9
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF contains a significant number of external links, identified as a PDF SEO link farm, with the dominant host being cheytownlady.com. This, combined with a visual download button lure and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', strongly suggests a phishing or malicious content distribution scheme. The embedded document body text, though heavily corrupted, contains references to 'Smallpdf Desktop' and 'Convert pdf to excel online', likely part of the lure. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cheytownlady.com/uploads/1/3/0/7/130776823/a6c9859249566.pdf
    • http://1-to-6.com/uploads/1/3/0/5/130543053/23f171ac6.pdf
    • http://stpetegolfcart.com/uploads/1/3/0/6/130621058/2627812.pdf
    • http://www.capexrentalsolutions.com/uploads/1/3/0/3/130313513/8087775.pdf
    • http://top20wordpress.com/uploads/1/3/0/6/130639071/f8694.pdf
    • http://veganwear.org/uploads/1/3/0/5/130550824/gesozidomopi.pdf
    • http://www.sssstop.com/uploads/1/3/0/5/130588658/sezazuxadawaritum.pdf
    • http://houseoftheanimal.com/uploads/1/3/0/8/130874017/jozikur_wirugijef.pdf
    • http://pianoninja.net/uploads/1/3/0/6/130639351/1e222f.pdf
    • http://mail.uvvc.ca/uploads/1/3/0/9/130969294/nabowozobogadoza.pdf
    • http://www.pinevilledui.com/uploads/1/3/0/7/130776407/fuwininuxedubuvemir.pdf
    • http://blog.soapdelicatessen.com/uploads/1/3/0/6/130605016/3792720.pdf
    • http://ygardens.net/uploads/1/3/0/5/130589299/vixigupif.pdf
    • http://www.theluxuryworldtraveler.com/uploads/1/3/0/2/130291689/lunakekojupojodibafu.pdf
    • http://www.lynnslavender.net/uploads/1/3/0/6/130621467/1460397.pdf
    • http://mta-sts.mail.hardwaresolutions-la.com/uploads/1/3/0/5/130550874/sezam_dagizu_mopixolelated.pdf
    • http://yenisiteniz.com/uploads/1/3/0/4/130476447/zaliligo-remoxamini-gagesasumawo-nenixuvunoze.pdf
    • http://mta-sts.mail.sheknowsadventure.com/uploads/1/3/0/2/130271060/dugidobozazanim_minazafur.pdf
    • http://monteschoenstatt.org/uploads/1/3/0/2/130270804/e066df3da3c0.pdf
    • http://chrisennisrealtor.com/uploads/1/3/0/6/130604407/728610.pdf
    • http://raediantevents.com/uploads/1/3/0/5/130588983/af4cdaa1.pdf
    • http://1kqmn.salon225.com/uploads/1/3/0/4/130476908/130476908.html#convert+pdf+to+excel+online+yang+bagus
    • http://www.lynnslavender.net/uploads/1/3/0/6/130621467/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e5a.bin
0bc78524babb4103b384252b7bced7f29444b0f572abe8137105d043f24d19c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E5A 7760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.