Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc5737be0308568a…

MALICIOUS

PDF

38.5 KB Authoring application: ImageMagick
MD5: 43cfbabf671216885e71c34ee4b63c07 SHA-1: f891698532145721d82f1013a78a911654611bf3 SHA-256: dc5737be0308568a9c94ed73a760f176648e0c69749fecb7cd738aab93205d81
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body's content appears to be corrupted or irrelevant, making the analysis rely heavily on the heuristic findings and the extensive list of URLs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nidustheatrearts.co.uk/uploads/1/3/0/6/130620492/b58426b43e0d2.pdf
    • http://smartgridman.com/uploads/1/3/0/6/130620159/7007754.pdf
    • http://nelancasterhub.org/uploads/1/3/0/6/130603696/29a7ac7b30bbc.pdf
    • http://hire-display-panels.com/uploads/1/3/0/7/130775584/8539292.pdf
    • http://www.joachim-m-schmidt.com/uploads/1/3/0/3/130323091/eb66a123a6d9f78.pdf
    • http://montanahorsesandmules.com/uploads/1/3/0/4/130477420/cf73afb517c.pdf
    • http://powertospeaknaked.com/uploads/1/3/0/5/130589006/9915131.pdf
    • http://nefaerieousdeeds.com/uploads/1/3/0/6/130621294/tanoxikerovevepotoma.pdf
    • http://yinzertrashed.com/uploads/1/3/0/6/130603890/nosarawuvuvuvuv-wirik.pdf
    • http://peacefultomorrow.net/uploads/1/3/0/6/130604788/dfeb204951.pdf
    • http://perthcleaningservice.com/uploads/1/3/0/5/130542813/pofam-nuxibowemeg-kilodi.pdf
    • http://sourkittylabs.com/uploads/1/3/0/6/130621622/zepojowebifezilag.pdf
    • http://supertoadrecord.com/uploads/1/3/0/6/130639220/6595cacfcd0.pdf
    • http://5125907747.com/uploads/1/3/0/4/130489019/d3d12.pdf
    • http://assetprotectionlawyers.info/uploads/1/3/0/6/130621307/sewikidojugifemilif.pdf
    • http://kelsweet.com/uploads/1/3/0/7/130738676/xaxuxosajuwativu.pdf
    • http://onlinemobiletrainer.com/uploads/1/3/0/7/130775197/02967ba330f95.pdf
    • http://eugendoyen.com/uploads/1/3/0/2/130287221/vupeginajoki.pdf
    • http://thelakecampground.com/uploads/1/3/0/7/130739301/1745805.pdf
    • http://www.phototoursnz.com/uploads/1/3/0/8/130874139/fodazisuvi.pdf
    • http://www.the-daily-flower.com/uploads/1/3/0/6/130605471/2b8672e7.pdf
    • http://contact.dng.ie/uploads/1/3/0/5/130539084/zixotug-jufofigaxofizuk-vijujiduw-wuwuwowafaw.pdf
    • http://myronwolmandesigns.com/uploads/1/3/0/6/130640181/843486b69858.pdf
    • http://newsite.juliedoherty.com/uploads/1/3/0/2/130289629/basamokevowuzat.pdf
    • http://mightypunk.com/uploads/1/3/0/5/130589338/87d9667aa050ed4.pdf
    • http://flex87.pleasingfood.com/uploads/1/3/0/5/130551464/130551464.html#andhra+pradesh+polytechnic+lecturers+notification+2018
    • http://peacefultomorrow

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031f4.bin
3a6d99d34dda9d32102f17cce7c23289e045a42ed03f2b054fb04d936b8ea789		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31F4 7764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.