Malicious PDF — malware analysis report

Static analysis result for SHA-256 dcc52453b5ac0989…

MALICIOUS

PDF

38.1 KB Authoring application: Smallpdf Desktop
MD5: 3d1b61239ed888c742f1e263c5e75e1f SHA-1: afb9ae469e34850adf2405aed83240e6efb83ec8 SHA-256: dcc52453b5ac098922d9702343c58923354eb6cfe13261f20cb9bef338141f26
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body itself appears to be corrupted or contains irrelevant text, making it difficult to ascertain a specific lure beyond the link farm. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.bellbridgeps.com/uploads/1/3/0/5/130588779/0b1c8b.pdf
    • http://narragansettgunclub.org/uploads/1/3/0/5/130543121/kifizabefifiletofako.pdf
    • http://advantageinsuranceagency.net/uploads/1/3/0/6/130639226/8051906.pdf
    • http://bicepsandbananas.com/uploads/1/3/0/4/130483487/sukorusa.pdf
    • http://northbrisbanebutcher.com/uploads/1/3/0/6/130621776/rugigoxu-jetowure.pdf
    • http://gruptrip.com/uploads/1/3/0/4/130476066/zosek.pdf
    • http://legalpaws.com/uploads/1/3/0/8/130873894/wakujafisigari_ridinaf_tefafisebil.pdf
    • http://nguyentandung.net/uploads/1/3/0/2/130270892/f9e23e1.pdf
    • http://dynamicathleticcenter.com/uploads/1/3/0/5/130547340/vofebiwiwewa.pdf
    • http://reliablelimoja.com/uploads/1/3/0/4/130488891/6d1886564.pdf
    • http://metrohomeorganizer.com/uploads/1/3/0/2/130288416/nanutixipetopixuke.pdf
    • http://caonaboenterprises.com/uploads/1/3/0/6/130604723/1978000.pdf
    • http://greecejapan.net/uploads/1/3/0/6/130621473/13c46f0243e5b81.pdf
    • http://moms-space.net/uploads/1/3/0/7/130739053/lujorerokove-mewaxetidititis-xejajiwetil.pdf
    • http://trueelegancetransportation.com/uploads/1/3/0/6/130620857/dufabuj.pdf
    • http://digitalbusinessinsider.net/uploads/1/3/0/6/130621669/0e06122cae.pdf
    • http://jupita.com/uploads/1/3/0/3/130313035/lefokotuvolima-rimupaduzijev-metogebavom.pdf
    • http://worldofvibes.com/uploads/1/3/0/5/130550879/vojuzegolujakelevo.pdf
    • http://maverickworldtravel.voyagerwebsites.com/uploads/1/3/0/5/130550711/130550711.html#gta+v+online+infinite+money+glitch

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000364d.bin
6c92ac7a3efc3af07f528b637e01e5c2324c2404ac8e035f962fdb63f370987e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x364D 8232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.