Malicious PDF — malware analysis report

Static analysis result for SHA-256 de8ebd2c78dc6175…

MALICIOUS

PDF

36.7 KB Authoring application: Inkscape
MD5: 5149fe39e9be92b203578af55ab37e8d SHA-1: b80b106341baf53bb5862580a4b30dd16884593e SHA-256: de8ebd2c78dc617539bf7684f17b0a73909b0dbfa311fbcb02f23b4df9dcc969
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file exhibits characteristics of a link farm, with numerous embedded URLs pointing to other PDF documents. This is strongly indicative of a phishing or SEO spam campaign designed to drive traffic to malicious or deceptive content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports this assessment.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://365poolspa.com/uploads/1/3/0/5/130589080/6261159.pdf
    • http://claytonheightssportmassage.ca/uploads/1/3/0/5/130590588/peziranazo.pdf
    • http://ardsleylatin.org/uploads/1/3/0/6/130604105/manatasu.pdf
    • http://neworleansgainswave.org/uploads/1/3/0/3/130379272/4722973.pdf
    • http://657maidmarion.com/uploads/1/3/0/5/130588210/ee7a9a.pdf
    • http://blatherscatdesign.com/uploads/1/3/0/6/130639950/8460553.pdf
    • https://xobebogome.weebly.com/uploads/1/3/0/2/130289549/dakukerojoto_lisorabotos_kutox_ropifojosok.pdf
    • http://pameladirnberger.com/uploads/1/3/0/2/130289765/c6e47268.pdf
    • http://pimaw.beabadocompositor.com/uploads/2020/01/28/4550879.pdf
    • https://tapefolixagene.weebly.com/uploads/1/3/0/4/130489090/7448195.pdf
    • http://nailsbymargaret.com/uploads/1/3/0/6/130604940/c7934e8a518.pdf
    • http://mrgermansweebly.com/uploads/1/3/0/6/130621294/xadufamo.pdf
    • http://drcarolineclarke.com/uploads/1/3/0/3/130379363/4313792.pdf
    • http://mew3mew.studio/uploads/1/3/0/5/130543029/0eb0bb0b.pdf
    • https://votefarani.weebly.com/uploads/1/3/0/2/130289189/1682983.pdf
    • http://cfthomas.com/uploads/1/3/0/6/130621149/130621149.html#addictive+drums+keygen+team+air+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015b1.bin
a2cca32f2ebbcdb1c2a242376fedfd4a30433457eabcee0285de692484c3deb6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15B1 8648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.