Malicious PDF — malware analysis report

Static analysis result for SHA-256 df8bfeb7ed41e448…

MALICIOUS

PDF

79.4 KB Authoring application: Smallpdf Desktop
MD5: 8600638ee6a6c4ea6681c22fa11c1bd5 SHA-1: 554d40e09befba12da0dc0f1bcd00e01132ed567 SHA-256: df8bfeb7ed41e448c3fa40dd145fb712c2993cb46a7432072f8caafaadcc8103
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF file contains a significant number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body, though heavily corrupted, contains references to external URLs, reinforcing the link-based attack vector. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://doublehranch.ca/uploads/1/3/0/5/130544078/daxot.pdf
    • http://aquariusfunding.com/uploads/1/3/0/5/130590687/b0fb3.pdf
    • http://packingoptimizer.net/uploads/1/3/0/6/130621225/4536211.pdf
    • http://northweststeamart-uk.com/uploads/1/3/0/6/130605279/gibalipaposis.pdf
    • http://misssoutheastpageantry.us/uploads/1/3/0/6/130621832/130621832.html#cadillacs+and+dinosaurs+game++online

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001125.bin
6187fd6f4f5087ab335bc9ceb11c8a62074ccbf586e332a197a2867281376855		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1125 9260 bytes
font_01_sfnt_off0000f0d2.bin
4fd0d5db35a02c872c4e1bbe21335187a332b0694cdb8a3a1138cf5b374453c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0D2 7300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.