Malicious PDF — malware analysis report

Static analysis result for SHA-256 e053e5dd7be9dc56…

MALICIOUS

PDF

50.8 KB Authoring application: Soda PDF
MD5: 9312c298f185901452c4072493497c6d SHA-1: 8c820581fdcab1f8b8b09200eb1ecac99871e5a6 SHA-256: e053e5dd7be9dc566fb84d84715098def8df1875df4b094ec519f68c358ff6a2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection further confirms its malicious nature, identifying it as Pdf.Phishing.TtraffRobotInstall. The embedded URLs suggest a phishing or content distribution scheme, aiming to redirect users to potentially harmful content hosted across multiple domains. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.bowenislandrecyclingdepot.com/uploads/1/3/0/5/130590582/gawuzajozek.pdf
    • http://brittanyschmidt.net/uploads/1/3/0/9/130969076/bd0dbe.pdf
    • http://mta-sts.mail.kunamokstmural.com/uploads/1/3/0/8/130873795/fejopati-juximulevivuri.pdf
    • http://nchuntlumber.net/uploads/1/3/0/5/130539227/livaramodu.pdf
    • http://usaroaddog.com/uploads/1/3/0/5/130545816/0149a89.pdf
    • http://thinkingfunny.info/uploads/1/3/0/5/130539992/5ba32d654d346.pdf
    • http://elenyacht.net/uploads/1/3/0/3/130313433/bcfe95.pdf
    • http://thecounselxpress.com/uploads/1/3/0/6/130605283/360d3e7cef2.pdf
    • http://mindfulnessrocks.com/uploads/1/3/0/8/130813654/c11db7.pdf
    • http://novovivo.org/uploads/1/3/0/7/130739974/dc94187ba42ef.pdf
    • http://daycareplayground.com/uploads/1/3/0/5/130550981/8351646.pdf
    • http://sthfromnth.com/uploads/1/3/0/6/130605263/66455054b3805.pdf
    • http://mypakalolochocolates.com/uploads/1/3/0/6/130603785/9173753.pdf
    • http://wellmedexpress.com/uploads/1/3/0/8/130813033/582f5396a6fdf2d.pdf
    • http://shikuangzuqiu2013buding.br3h.com/uploads/1/3/0/5/130543320/130543320.html#national+geographic+magazine+september+2017+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c0f.bin
239bdaf23877b9e1735905fe54f73791dd097b0a30802e9a87d7324b9052f51b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C0F 8700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.