PDF malware analysis — malicious · f1e666cec806e2b3

MALICIOUS

PDF

42.2 KB Authoring application: Adobe PDF Library 9.0

MD5: 446870e4bafda1fa7f586c39a4672dc4 SHA-1: f88d92c36120ca1447c6ec6055f6528e41c39425 SHA-256: f1e666cec806e2b35aaa55a6922145d92eff0f6b4a43ea51999cf8e65f082706

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO poisoning attack, aiming to redirect users to potentially malicious content hosted on various domains. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the malicious intent. No scripts were extracted from this sample.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://tutorvirginia.com/uploads/1/3/0/6/130621897/39c9332b.pdf
- http://teestressrelief.com/uploads/1/3/0/7/130775704/5386588.pdf
- http://monkonmolokai.com/uploads/1/3/0/2/130271082/gimunanafi.pdf
- http://julesjourneys.net/uploads/1/3/0/2/130274376/wenageti-jufuwed-ledasetim-norepupoba.pdf
- http://apietrantoni.com/uploads/1/3/0/2/130287890/zefijusijegonun.pdf
- http://m40925.com/uploads/1/3/0/5/130590583/1203768.pdf
- http://bouncybako.com/uploads/1/3/0/7/130776672/dizovotiribon-kidikekemo-jigimugada-zutorogis.pdf
- http://plataformaciudadana.net/uploads/1/3/0/6/130604144/3746821.pdf
- http://ansepacceleration.net/uploads/1/3/0/7/130739253/raxevirujuva.pdf
- http://americanbeachphoto.com/uploads/1/3/0/6/130620813/9b3e78933be.pdf
- http://krugmanwasright.com/uploads/1/3/0/4/130490250/5ec4ca3e9ba0ee.pdf
- http://mrbcontructionllc.com/uploads/1/3/0/7/130739153/lobudog.pdf
- http://christinacarnesphotography.com/uploads/1/3/0/5/130544070/3233957.pdf
- http://kateshawauthor.com/uploads/1/3/0/5/130540083/60d05c6b1.pdf
- http://mail.chicagopcc.com/uploads/1/3/0/2/130287529/6cb2a5d1a36.pdf
- http://sunshinepics.net/uploads/1/3/0/7/130776054/9b7339b8b3.pdf
- http://www.mediaturbo.org/uploads/1/3/0/7/130775531/69b82858c2.pdf
- http://jhsassociatesinc.com/uploads/1/3/0/5/130588529/d0a8321922.pdf
- http://tomsalf.store/uploads/1/3/0/2/130288731/kiriwuziti.pdf
- http://pocketultrasounds.com/uploads/1/3/0/3/130379429/kejebixitigaloriso.pdf
- http://web-design.creps-inc.jp/uploads/1/3/0/7/130740250/1f028de528e22ef.pdf
- http://ulcergardforhorses.com/uploads/1/3/0/4/130488311/bc9cff8.pdf
- http://flatearthgathering.org/uploads/1/3/0/8/130813511/2b09a674b0b.pdf
- http://authorkirstyferguson.com/uploads/1/3/0/7/130738706/kuxogeterub_zakozikut.pdf
- http://trust-trade.net/uploads/1/3/0/2/130289610/451590.pdf
- http://74-123-72-13.mgwnet.com/uploads/1/3/0/2/130270813/130270813.html#ac750+wireless+dual+band+gigabit+router+model+no.+archer+c2

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002ec0.bin` `d5ed1c3e32e121bc7fdf4b7f64e9f52042883cdc8d0b4eb1f0c73bff7e2be32e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2EC0	4236 bytes
`font_01_sfnt_off00003ec8.bin` `484cf8db97dd2db29b91b8859068a09c503901c55c988125938cc73146a03244`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3EC8	8556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.