Malicious PDF — malware analysis report

Static analysis result for SHA-256 f168b95bd5faf8d0…

MALICIOUS

PDF

40.0 KB Authoring application: Adobe PDF Library 9.0
MD5: 870dd60405b98ce7aed5125b5ade9e3d SHA-1: bc430a1f3b6927a5044341937d0575f605828f0a SHA-256: f168b95bd5faf8d089bdf4cef83a0656080c54c078d6761f3fd4e4498f2bc5d9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mentorconcrete.com/uploads/1/3/0/2/130289431/1818683.pdf
    • http://susanpultman.com/uploads/1/3/0/2/130291355/denejekujepaxe_jewatovitobimaw_kuresipuke_vepuponulo.pdf
    • http://missfass.com/uploads/1/3/0/2/130288301/gazaneguran-zimivomi-durorefi-xovowabavonawe.pdf
    • http://krazy-verns-carwash.com/uploads/1/3/0/6/130639805/dorawuno.pdf
    • http://comecleandetail.com/uploads/1/3/0/5/130551991/70fb7d6eb05.pdf
    • http://aeropac.vip/uploads/1/3/0/5/130538902/230867.pdf
    • http://novelendings.com/uploads/1/3/0/8/130814408/1501964.pdf
    • http://ssuvhsg.ch/uploads/1/3/0/3/130379674/4057968.pdf
    • http://willslachance.com/uploads/1/3/0/2/130270837/6402334e13fbb88.pdf
    • http://practicalstartupbook.net/uploads/1/3/0/6/130620847/552045.pdf
    • http://gold-etf-losses.com/uploads/1/3/0/8/130874042/vuwogerobalogixaj.pdf
    • http://kirillian.net/uploads/1/3/0/2/130289797/momazemiruzuf.pdf
    • http://sylteszeri.com/uploads/1/3/0/7/130775259/gowoduxi.pdf
    • http://lakehomemag.com/uploads/1/3/0/6/130639511/losiseretupoxetone.pdf
    • http://winewiseidaho.com/uploads/1/3/0/7/130775990/zadop.pdf
    • http://shakti-circus.com/uploads/1/3/0/5/130543190/sitapokipizetaxekiko.pdf
    • http://mooreinnovation.org/uploads/1/3/0/7/130740212/nesubadut.pdf
    • http://tcsonline.net/uploads/1/3/0/5/130551777/130551777.html#trastorno+de+ansiedad+con+agorafobia+dsm+v
    • http://gold-etf-los

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e5c.bin
c466b9ab3ecba56026cd0e568295cbabceaa24686df1c62eaeec076b5c36c5c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E5C 8920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.