Malicious PDF — malware analysis report

Static analysis result for SHA-256 eda038307c733ea7…

MALICIOUS

PDF

50.1 KB Authoring application: Mobipocket Creator
MD5: 6af2173cb1f3a41e9b2166942fc77258 SHA-1: e796d356e7b848bee23679f9c6f5459d33bd3af6 SHA-256: eda038307c733ea7866eb3e2329cdbee880342a2d78afa258f2e51cfafaa99cd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links to other PDF files hosted on various domains. This behavior is indicative of a link farm designed to distribute malicious content or conduct phishing attacks. The ClamAV detection further supports its malicious classification as Pdf.Phishing.TtraffRobotInstall-7605656-0.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://miam-foundation.org/uploads/1/3/0/4/130435531/tuzijuga_jikuxidotigid.pdf
    • http://nhbcworshipministry.com/uploads/1/3/0/6/130605443/fadij.pdf
    • http://inlucem.net/uploads/1/3/0/5/130550683/a0122.pdf
    • http://info2read.online/uploads/1/3/0/5/130588617/0b00a7e040a.pdf
    • http://costwiseaccounting.com.au/uploads/1/3/0/4/130483953/9a5dffcc146d.pdf
    • http://www.southbeltongt.net/uploads/1/3/0/7/130739746/8701541.pdf
    • http://www.sophiapodhaisky.com/uploads/1/3/0/5/130551378/1040db6a.pdf
    • http://webmail.dustibonge.org/uploads/1/3/0/8/130874299/6104450.pdf
    • http://chapelhill.plus/uploads/1/3/0/6/130603861/0d7f1839812b3ce.pdf
    • http://fiscalnoteevents.com/uploads/1/3/0/3/130323236/390270196c95e.pdf
    • http://aobassociates.com/uploads/1/3/0/7/130775806/e322b5eef3f2d46.pdf
    • http://www.sky-high-party-rentals.com/uploads/1/3/0/2/130289543/rewajijubudoparixule.pdf
    • http://mistersac.net/uploads/1/3/0/6/130621108/6d71c74eb29bb44.pdf
    • http://74-123-77-223.mgwnet.com/uploads/1/3/0/5/130539584/130539584.html#the+furies+2019+plot+summary

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006cc5.bin
7d6835123b5efb3cb86183e7bb006a21ff16060943bb6489896e6beec47c37f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CC5 7696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.