Malicious PDF — malware analysis report

Static analysis result for SHA-256 edcfb15937142fb4…

MALICIOUS

PDF

38.6 KB Authoring application: Soda PDF
MD5: 3b1bd1cf222e02fde6a984ecfc5f2d34 SHA-1: 1e1b0487170fc5cf69488ab6d7a669f6968789b3 SHA-256: edcfb15937142fb4f75d34c93035b0ba8598656f706cc59ccf349e2292976206
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links predominantly point to PDF files hosted on various domains, suggesting a link farm or redirection scheme. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cowgirlcloset.co/uploads/1/3/0/2/130270921/malexi.pdf
    • http://www.myfish.tw/uploads/1/3/0/7/130775972/d41c532ed8ae.pdf
    • http://eefkeduin.nl/uploads/1/3/0/7/130775934/kemasagimuli_jetamizuxor_panufezotor.pdf
    • http://mta-sts.mail.cpliofindiana.org/uploads/1/3/0/5/130551941/mavusof.pdf
    • http://fundaciondrguillermocutuli.com/uploads/1/3/0/6/130621082/7839687.pdf
    • http://westernhomesecurity.com/uploads/1/3/0/4/130490421/9a6600555.pdf
    • http://eatthinkwin.com/uploads/1/3/0/4/130488839/024f27e1ead6.pdf
    • http://queenkristene.com/uploads/1/3/0/4/130483489/wafutunawive.pdf
    • http://xgens.org/uploads/1/3/0/5/130543976/jifetu-kesiwejozamuf-nubedefo-vuwivomeperomed.pdf
    • http://nicolemfraley.com/uploads/1/3/0/8/130814112/dedimutune_goremefijes_vivopufigevugeb.pdf
    • http://xtwdn6.brdge.org/uploads/1/3/0/3/130323596/mejor.pdf
    • http://sobolagroup.com/uploads/1/3/0/3/130379352/b0f78b642f168e.pdf
    • http://eveningshadows.org/uploads/1/3/0/4/130488220/fifijeranotu.pdf
    • http://nalbarra.com.au/uploads/1/3/0/3/130323232/6960277.pdf
    • http://bearvsbaby.net/uploads/1/3/0/7/130739235/64be1.pdf
    • http://madisonandarveentietheknot.com/uploads/1/3/0/3/130323466/mimete-wasidiweze-sojiluxomujan-vevaluvoxe.pdf
    • http://mrfriedliclass.com/uploads/1/3/0/6/130621158/purig.pdf
    • http://eastermeditationretreat.org/uploads/1/3/0/7/130738847/aaefa5b5d.pdf
    • http://mail.fitilis.gr/uploads/1/3/0/7/130775513/sujuzadaluxovenes.pdf
    • http://mustoelaw.com/uploads/1/3/0/7/130775907/7867074.pdf
    • http://816nc751.com/uploads/1/3/0/6/130621048/2a97905.pdf
    • http://paraisoindustrial.com/uploads/1/3/0/4/130483625/8582116.pdf
    • http://www.alnouraldaem.com/uploads/1/3/0/7/130740086/3571256.pdf
    • http://professionalrenovationsofhamptonroads.com/uploads/1/3/0/2/130270990/3645505.pdf
    • http://www.projectindigo.nl/uploads/1/3/0/2/130289282/jowiridufonaguf_fexaluw_zunup.pdf
    • http://www.ivars-nettoyage.fr/uploads/1/3/0/2/130274097/130274097.html#ecg+sinus+bradycardia+otherwise+normal
    • http://mrfriedliclass.com/uploads/1/3/0/6/130621158/purig

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032cc.bin
be77b0e2efb0eca9734dcf319c041a4c3646597908d495e894af028326111231		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32CC 7756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.