Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4ecefb3ee040677…

MALICIOUS

PDF

38.2 KB Authoring application: Adobe PDF Library 9.0
MD5: faceee7c77d72082f44aa3865da1aea0 SHA-1: c20c8c38c9094e12f0395be50405eb76d16b8eff SHA-256: f4ecefb3ee040677846cbb16cd5e67dac8da042779ea6047742f80c65ca59d01
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm with 19 external URLs, suggesting a phishing or redirection attempt. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicates a phishing campaign. The presence of a visual download button further supports the lure-based attack pattern. No scripts were extracted, limiting the analysis to the document's structure and embedded links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lifit.co.jp/uploads/1/3/0/5/130590467/paruto.pdf
    • http://earthforanimals.com/uploads/1/3/0/8/130813317/be17673885197.pdf
    • http://doubleknives.com/uploads/1/3/0/2/130271043/5500339.pdf
    • http://ww.ludwellstores.co.uk/uploads/1/3/0/7/130739022/torimopovinanexodiva.pdf
    • http://acmeessence.net/uploads/1/3/0/8/130814467/0d157b5.pdf
    • http://jordanangeli.com/uploads/1/3/0/4/130436089/vusufoves-kerinofokavisel-filewu-boluj.pdf
    • http://moonrisetours.com/uploads/1/3/0/4/130476601/3595799.pdf
    • http://kosherfoshan.com/uploads/1/3/0/4/130491488/80f86418.pdf
    • http://chloepettigrew.com/uploads/1/3/0/6/130620928/3826516.pdf
    • http://hashtagbottles.com/uploads/1/3/0/5/130540366/lizotipenowo_kexovitunit_wipidix_denad.pdf
    • http://bluecandyridge.com/uploads/1/3/0/6/130640047/kabetizonig.pdf
    • http://garlandcrew.com/uploads/1/3/0/4/130435930/3685487.pdf
    • http://noticiasinternacionales.net/uploads/1/3/0/6/130620979/zekib-jabek-zudodavibomoli-suravirapibabo.pdf
    • http://lookgreatnakedatanyage.com/uploads/1/3/0/7/130776680/jibovonaxezoj-derevup.pdf
    • http://natemalone.com/uploads/1/3/0/7/130776516/sereborapotu.pdf
    • http://keelancole.com/uploads/1/3/0/8/130814010/mukipivetixuw.pdf
    • http://ketoexpofest.com/uploads/1/3/0/8/130874269/vaxakudawog.pdf
    • http://romehighnews.info/uploads/1/3/0/2/130289226/436d0.pdf
    • http://woodlandstuition.com/uploads/1/3/0/4/130476896/130476896.html#pdf+to+excel+converter+crack+version+free+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003536.bin
5db6b3b2cc9c57f6ef3f7fab574df4e0f3b0b8513b88418bdae5744febe05e05		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3536 8752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.