Malicious PDF — malware analysis report

Static analysis result for SHA-256 e49c5c5608af0673…

MALICIOUS

PDF

32.9 KB Authoring application: ImageMagick
MD5: 52402edb480b44d123dfd0ff1208c6b2 SHA-1: af0c709fb74ce5f1094bff275978be1e63704a71 SHA-256: e49c5c5608af06730e5b5e76e5a47d37eceb29232a7ba02669f45a63090fa7c2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://duisae.com/uploads/1/3/0/3/130324164/naxirawude.pdf
    • http://stankarwoski.com/uploads/1/3/0/7/130776230/viregaxuvutajeseroji.pdf
    • http://jennycatalano.com/uploads/1/3/0/2/130288926/govubizuvagosu.pdf
    • http://thegentlemansfarm.net/uploads/1/3/0/2/130272976/dezof-fodosuxa.pdf
    • http://mercyministrystl.org/uploads/1/3/0/5/130589104/godukoxilosipupesoxe.pdf
    • http://airfishy.com/uploads/1/3/0/7/130776081/riroxo.pdf
    • http://isladelplacer.com/uploads/1/3/0/5/130589252/pitopimifo_pebiluzubole_suxol.pdf
    • http://walkersshuttlexpress.com/uploads/1/3/0/2/130287521/1372273.pdf
    • http://zriiaustralia.com/uploads/1/3/0/2/130270833/vosogelet.pdf
    • http://cpanel.medien.com.my/uploads/1/3/0/2/130272963/6777671.pdf
    • http://dankennedytheowl.com/uploads/1/3/0/5/130589047/3934294.pdf
    • http://jeremyhammer.com/uploads/1/3/0/5/130546283/gifibikuwugutup.pdf
    • http://hostmaster.wholehi.com/uploads/1/3/0/7/130738629/748e1eb.pdf
    • http://irieint.com/uploads/1/3/0/5/130589125/130589125.html#alcohol+withdrawal+induced+seizure+icd+10
    • http://stankarwoski.com/uploads/1/3/0/7/130776230/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000029e9.bin
941028ab00734473b6913988f0b2c7113a4c7bd5d374b902285d72ecf3020ec4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x29E9 7148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.