Malicious PDF — malware analysis report

Static analysis result for SHA-256 da103c750e218065…

MALICIOUS

PDF

35.3 KB Authoring application: pstoedit
MD5: 4df508c9dc8965ff552f1607603a8f8a SHA-1: 14ecaaeaaae02df2f4142b2feb3c670c6871bfe9 SHA-256: da103c750e21806553b8dc510a73cd5c77e6838681f73472cddcc29141edf178
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits a critical heuristic firing for PDF_SEO_LINK_FARM, indicating a mass of external links. ClamAV also detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0. The embedded URLs are likely part of a phishing or SEO manipulation scheme, aiming to redirect users to potentially malicious content hosted on various domains. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://murraygoldstein.com/uploads/1/3/0/7/130740017/9320040.pdf
    • http://nestpsychiatry.com/uploads/1/3/0/6/130620395/7585700.pdf
    • http://faithfoodfamily.blog/uploads/1/3/0/5/130539297/2125788.pdf
    • http://bridgepointsearch.com/uploads/1/3/0/8/130874030/e69c5931235e18.pdf
    • http://www.sweetwatermanors.com/uploads/1/3/0/5/130551051/fepodipoku_lesife_tujixalazegi.pdf
    • http://hamlearn.com/uploads/1/3/0/4/130478163/fa28e73.pdf
    • http://mitel5000.utahfire.com/uploads/1/3/0/5/130547552/8957156.pdf
    • http://bearvbaby.org/uploads/1/3/0/3/130313176/9c55810b783db9.pdf
    • http://bepatientcaregiving.com/uploads/1/3/0/2/130270906/raxug.pdf
    • http://caramelosweetshop.co.uk/uploads/1/3/0/5/130589316/betakuramupazit.pdf
    • http://sammiegeislerdpt.com/uploads/1/3/0/7/130775050/6a74dfafbf5b168.pdf
    • http://zongtongzuigaohuo288tiyanjin.br3h.com/uploads/1/3/0/6/130640223/1982e9f.pdf
    • http://kkompani.com/uploads/1/3/0/5/130590195/vejalowakokamugapite.pdf
    • http://r3healthandfitness.com/uploads/1/3/0/5/130543483/603bd.pdf
    • http://placegram.net/uploads/1/3/0/4/130483645/gabatul.pdf
    • http://girishchavan.net/uploads/1/3/0/2/130291783/31ad5d71d6e7537.pdf
    • http://wcd-3az2qzm.mgh-r.ch/uploads/1/3/0/5/130547576/130547576.html#google+translate+camera+english+to+hindi+app+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ea3.bin
7d69372a46adb5b1e6fa2bc565bf571850829ea76c1fa10c9081f1bd8968fae9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EA3 7804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.