Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1772e3c40bfdd3f…

MALICIOUS

PDF

47.9 KB Authoring application: Adobe PDF Library 9.0
MD5: 47f7aee5a12008763c28b74a2ea91f23 SHA-1: 7a5543e737f3ea753906b4f40142588859f64eda SHA-256: f1772e3c40bfdd3fad5d91a5859deb696aa721cd72e272654f2ba5536a5d37dd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various domains and are likely used to manipulate search engine results or redirect users to malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beaconclean.com/uploads/1/3/0/5/130540281/44525f2a92358.pdf
    • http://sotopressurewashingandpainting.com/uploads/1/3/0/7/130739539/5983115.pdf
    • http://elysianresources.net/uploads/1/3/0/6/130639257/kizidobaputira-kusibudedewa-nodipenesinok-fewofobe.pdf
    • http://scope-for-growth.com/uploads/1/3/0/5/130588675/4124942.pdf
    • http://mrworkman.ca/uploads/1/3/0/6/130620820/rapuripugegi.pdf
    • http://michaelajblogs.com/uploads/1/3/0/8/130874416/bbcb7d38b4543fb.pdf
    • http://plantsexpress.com.au/uploads/1/3/0/6/130639852/pafusobanifegidi.pdf
    • http://2030portal.com/uploads/1/3/0/6/130622120/jejiwap-kavib.pdf
    • http://legacyproshops.net/uploads/1/3/0/4/130476628/4011424.pdf
    • http://mknutritionsystems.com/uploads/1/3/0/7/130775985/4335410.pdf
    • http://nhvtencampment.nhcapcadets.org/uploads/1/3/0/5/130540085/8d766.pdf
    • http://deanrthornton.com/uploads/1/3/0/8/130813991/317b98.pdf
    • http://evilgamers.com/uploads/1/3/0/7/130775269/bf87617645d4.pdf
    • http://www.agilitysalesllc.com/uploads/1/3/0/8/130813528/pidagafimu-vufun-duwodixazuzut-mukarimal.pdf
    • http://kimberlysfarmsflowers.com/uploads/1/3/0/2/130272266/a571fb.pdf
    • http://movmentlab.com/uploads/1/3/0/5/130540642/tamenavamerol.pdf
    • http://quvr.us/uploads/1/3/0/8/130813466/2102036.pdf
    • http://dedicated-20.pleasingfood.com/uploads/1/3/0/2/130289676/130289676.html#afro+asiatic+language+family

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000450d.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x450D 16204 bytes
font_01_sfnt_off00005d7c.bin
afa351ecaee7224c6676d01405b6debbe7e21786369e5fe5ececda92a222c6d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D7C 9164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.