Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecf6ec482315ad35…

MALICIOUS

PDF

40.0 KB Authoring application: PDF Studio
MD5: 946a80ff2abe8532b42b754fed2eba46 SHA-1: 59a166295b1c54655f5616d51a3e5d37d0e66173 SHA-256: ecf6ec482315ad35cc94ee1e1bf8bb8530d83a377f2cd15c5e97d48a9b40bcc4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection intent. No scripts were extracted from this sample, but the sheer volume of outbound links is the primary indicator of malicious activity.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.growingbolderfitness.com/uploads/1/3/0/4/130488398/1374953.pdf
    • http://faceshieldgraphics.com/uploads/1/3/0/5/130545043/8051619.pdf
    • http://graceandflora.com/uploads/1/3/0/4/130436049/6316797.pdf
    • http://michelledabundo.com/uploads/1/3/0/7/130739140/dd8a60287.pdf
    • http://revivesupportservices.com/uploads/1/3/0/5/130551351/beliduvuko.pdf
    • http://lifeback.org.au/uploads/1/3/0/6/130639230/64f8020e5.pdf
    • http://cdrecord.com/uploads/1/3/0/2/130289741/mezizidokota.pdf
    • http://www.hollyyorston.com/uploads/1/3/0/8/130874372/7ad410e7.pdf
    • http://drinkhereplayhere.com/uploads/1/3/0/7/130774962/bogomaladux.pdf
    • http://brightbuzz.biz/uploads/1/3/0/7/130739404/584784.pdf
    • http://ugomicci.it/uploads/1/3/0/7/130739962/cbc02d47ff2.pdf
    • http://alfredveretto.com/uploads/1/3/0/4/130488362/zoxumarezava.pdf
    • http://sarahpoulgrain.com/uploads/1/3/0/5/130551153/bamagepu_fujumujib_gilezajifinuzo.pdf
    • http://vaccin8apparel.com/uploads/1/3/0/6/130603761/d0fbea73a68b9fe.pdf
    • http://pqhp.info/uploads/1/3/0/3/130313000/xafuxe.pdf
    • http://disspat.com/uploads/1/3/0/5/130539227/7532528.pdf
    • http://www.katherinendenton.com/uploads/1/3/0/5/130538956/2572072.pdf
    • http://coopstraining.com/uploads/1/3/0/7/130775740/2042535.pdf
    • http://royalanimals.com/uploads/1/3/0/7/130738504/zupepigap_wozibufesupu_muvoputu.pdf
    • http://oaktreecapllc.com/uploads/1/3/0/4/130489350/995a36c.pdf
    • http://northeconstruction.com/uploads/1/3/0/6/130605073/5782099.pdf
    • http://www.mx.elkethoms.com/uploads/1/3/0/6/130604602/taragopefo-femuravitowup-sisokubufumu-vujajoseri.pdf
    • http://kekcreates.com/uploads/1/3/0/6/130639554/2453135.pdf
    • http://theantilogy.com/uploads/1/3/0/7/130739117/1328600.pdf
    • http://seafoodfestivalgiveaways.com/uploads/1/3/0/5/130551218/130551218.html#how+to+embed+a+pdf+in+a+word+document+2010
    • http://oaktreecapllc.com/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000039ce.bin
6ea7e253bd4f93ca1b396a6a23369d2c464ca3498bdb9a4c15acdce01f98e277		 pdf-font-stream PDF embedded font (sfnt) at offset 0x39CE 7784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.