Malicious PDF — malware analysis report

Static analysis result for SHA-256 da25101d4498f25f…

MALICIOUS

PDF

34.2 KB Authoring application: GIMP
MD5: 5bcd0b137e923f4abf277ce98ca67557 SHA-1: d445d8a1ec2f24449472ecb5e857ef96d8e13494 SHA-256: da25101d4498f25f63e829712051ff627418a8f5a79766d56b26b9ad65dd5b80
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, while containing some legitimate text about back pain, also includes these links, suggesting a deceptive purpose. The primary goal appears to be directing users to a network of related PDF files hosted on various domains, likely for SEO manipulation or to serve as a distribution point for further malicious activities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://casadelvalleygalindo.com/uploads/1/3/0/8/130814562/binaweku.pdf
    • http://lixfood.com/uploads/1/3/0/7/130776740/fikolitozefogerageku.pdf
    • http://bronxrollingdoor.com/uploads/1/3/0/8/130813453/gibujanup.pdf
    • http://pressplayusa.com/uploads/1/3/0/3/130313624/e4ae8e7f68a0d.pdf
    • http://2findyourhomevps.net/uploads/1/3/0/2/130289782/bosurevidufo.pdf
    • http://elpatriarcado.club/uploads/1/3/0/5/130539049/fejozevutexemasekol.pdf
    • http://tiffinindia.ca/uploads/1/3/0/5/130551190/9716207.pdf
    • http://slowyourrolloki.com/uploads/1/3/0/2/130287503/8a67e3fde.pdf
    • http://sandybailes.com/uploads/1/3/0/6/130621407/doposexe.pdf
    • http://kingdomwealthcreatorsunite.com/uploads/1/3/0/6/130639896/neduvakazikajivexi.pdf
    • http://citywidevalet.com/uploads/1/3/0/4/130476203/9688342.pdf
    • http://74-123-76-212.mgwnet.com/uploads/1/3/0/4/130435590/130435590.html#exercise+protocol+for+low+back+pain

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030bf.bin
7c9cacfb1f9bd2e9cc2bcbfbfec588330f9a8e11028922ef5fa531ab063a6130		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30BF 7316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.