Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddc7c70e4cfff4f6…

MALICIOUS

PDF

36.1 KB Authoring application: Inkscape
MD5: 2e9bfd6f853f761c3a471c94458e4341 SHA-1: 51e5a1d8f083827cf01cd16336c79f3596c8de21 SHA-256: ddc7c70e4cfff4f6b4abb6d7086fe1592fee6ae79090097a2bf67fd44bccd13c
182 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded external links, many of which point to other PDF files, suggesting a link farm or SEO poisoning tactic. The heuristic 'SE_SECRET_RECOVERY_LURE' indicates the document explicitly requests sensitive recovery information such as private keys or backup codes. ClamAV also identified the file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', further supporting a phishing or malicious redirection intent. The embedded URLs are likely part of the lure or redirection chain.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://genxtraining.ca/uploads/1/3/0/5/130588501/visofiwovaru.pdf
    • http://palmspringsbachelor.com/uploads/1/3/0/4/130476065/1059922.pdf
    • http://silentxc.com/uploads/1/3/0/7/130740060/zusavokilulozeganan.pdf
    • http://retroskoda.com/uploads/1/3/0/3/130323232/vaweted.pdf
    • http://killerwailslive.com/uploads/1/3/0/2/130273812/sukamunigi.pdf
    • http://writersplot.com/uploads/1/3/0/4/130476624/5c94440ed9e64a7.pdf
    • http://estebanracing.com/uploads/1/3/0/5/130543667/9610299.pdf
    • http://bangkokrepublik.co/uploads/1/3/0/4/130476045/maxepomugunud.pdf
    • http://mail.congenitalheartdefects.com/uploads/1/3/0/5/130540592/b0b367567d.pdf
    • http://remoteremoval.com/uploads/1/3/0/6/130603946/mewexinusalu.pdf
    • http://jokes-today.com/uploads/1/3/0/8/130814237/2eab73afd91.pdf
    • http://dattebayo.net/uploads/1/3/0/6/130604014/6391423.pdf
    • http://caleb123.com/uploads/1/3/0/7/130775251/dakarozojowive.pdf
    • http://bayareasomaticpsychotherapy.com/uploads/1/3/0/5/130588579/sazajavutedebiputi.pdf
    • http://www.greenblackdress.com/uploads/1/3/0/5/130590412/130590412.html#windows+server+2008+active+directory+certificate+services
    • http://genxtraining.ca/uploads/1/3/0

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003331.bin
0cdb8e698c4e269e63498b53b1dc2a8ea5750b126b4f9fe2386862f33e0d6546		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3331 7936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.