Malicious PDF — malware analysis report

Static analysis result for SHA-256 daaa2ce968cc9adc…

MALICIOUS

PDF

61.2 KB Authoring application: PDFBox
MD5: 5c902f3f2001d1bda8ed9e23ad94e211 SHA-1: 5c493acb698e81c6167b6178c0874090d2257176 SHA-256: daaa2ce968cc9adc5bf9f55ab71839b386bc184de17db46fcfcc0ca547341f5a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1204.001 User Execution: Malicious Link T1566.002 Phishing: Spearphishing Link

The sample is a small PDF containing a high density of external links to other PDFs and HTML pages, triggering the PDF_SEO_LINK_FARM heuristic. The document body contains gibberish text and a list of URLs, which is characteristic of SEO poisoning and phishing campaigns. ClamAV detection as Pdf.Phishing.TtraffRobotInstall further supports the classification as a phishing delivery mechanism.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://100lifelessonswithsistergirl.com/uploads/1/3/0/5/130545597/728358.pdf
    • http://nylasvanity.com/uploads/1/3/0/3/130379293/192b092101.pdf
    • http://capoeirabayonne.com/uploads/1/3/0/6/130604378/08e46abb689.pdf
    • http://stjohnslutheranchurchjenison.org/uploads/1/3/0/6/130639175/zulonano-gitizilavibubu-nugapuvu-javudo.pdf
    • http://nuthoppers.com/uploads/1/3/0/5/130551319/jexowilawuve-rawil-bepan.pdf
    • http://eccevideos.com/uploads/1/3/0/3/130379638/xojoxivu.pdf
    • http://nataliegracewagner.com/uploads/1/3/0/2/130287943/ritokuziguxugipo.pdf
    • http://iglesiamulticulturalwestside.com/uploads/1/3/0/5/130588962/losata.pdf
    • http://justbcosmetics.com/uploads/1/3/0/6/130639443/rusigigabigitul-mokapaweredokon.pdf
    • http://aedutah.com/uploads/1/3/0/6/130605502/130605502.html#lines+written+on+tintern+abbey

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001288.bin
76bcdec721971a84ed86b28b706079bb860b6087a7abf2e4aafd787329beaa39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1288 8228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.