Malicious PDF — malware analysis report

Static analysis result for SHA-256 e549719068fc2529…

MALICIOUS

PDF

38.5 KB Authoring application: pstoedit
MD5: 3c43b07677f649e8d2afe68caecbbb1b SHA-1: 4cff116712abc645f811b5d95f3aee4b826e2778 SHA-256: e549719068fc2529eb2c337a98d21e096514e989d03dbbed039b36a024fae879
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent. The primary function appears to be redirecting users to numerous websites, likely for phishing or SEO spam purposes. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://keeponvacation.net/uploads/1/3/0/7/130739369/sajiruf-rosaga-desuviluzetok-kazabatalakopat.pdf
    • http://splitnest.com/uploads/1/3/0/5/130551967/c2c3c7.pdf
    • http://albanystudentpress.com/uploads/1/3/0/6/130621854/woxelezedo_rukadu_jodulepiguk.pdf
    • http://mta-sts.mail.macroswithmegs.com/uploads/1/3/0/7/130775295/jagar_depajaxuxifaz_danonudu_posigomavo.pdf
    • http://millenialpages.com/uploads/1/3/0/3/130379447/1568569.pdf
    • http://twistingtrailsandtales.com/uploads/1/3/0/2/130289803/06c088c321.pdf
    • http://fiataudiosolutions.com/uploads/1/3/0/8/130813784/mixapofakakobu-weziligo.pdf
    • http://www.azureholisticmodalities.com/uploads/1/3/0/3/130313494/809650.pdf
    • http://drdom.com.au/uploads/1/3/0/2/130274378/losuwolopilikutatozu.pdf
    • http://www.sunshinefitness7953.com/uploads/1/3/0/5/130588511/7831112.pdf
    • http://mwwrenovations.com/uploads/1/3/0/8/130813652/vadajado_zexedozosojinum.pdf
    • http://nextlane360.com/uploads/1/3/0/7/130738741/tegefaxepetu_zalurer.pdf
    • http://bloomwithdrwatson.com/uploads/1/3/0/5/130540209/c8d0f53f9fe928.pdf
    • http://www.teachntech.com/uploads/1/3/0/7/130739509/ad681.pdf
    • http://www.kathrynlynch.net/uploads/1/3/0/8/130874012/d1ae68bb589dc0.pdf
    • http://splitfingerstudio.com/uploads/1/3/0/2/130271030/nitut_wavixuxala_vanupenotivizo.pdf
    • http://robertoluigimauri.com/uploads/1/3/0/2/130287847/vedonoxim.pdf
    • http://chancetolovetravel.com/uploads/1/3/0/7/130740012/8138591368.pdf
    • http://www.shutyomouthfoodtruck.com/uploads/1/3/0/6/130621261/b382b2eb18e4fe4.pdf
    • http://qpcym.slpny.com/uploads/1/3/0/5/130551033/130551033.html#varicela+-+zoster+anticorpos+igg.+reagente

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035e9.bin
e79e897a0d453ed87f864be9bb6ec716e8179cd44ecf247d2f77b78b54f011b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35E9 9684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.