Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6497feadf883151…

MALICIOUS

PDF

39.4 KB Authoring application: ImageMagick
MD5: 70cea79426d86ee7aa24cbe5c64c8be0 SHA-1: 597e99d066f5626a3eac934f9088caf845938e55 SHA-256: f6497feadf8831519d2056352de16773e93daefb9e885a69702c8575a82f7f63
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits a critical heuristic firing for PDF_SEO_LINK_FARM, indicating a mass of embedded external links. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The primary attack pattern involves redirecting users through numerous URLs, likely to phishing sites or to download further malware. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sdorsher.com/uploads/1/3/0/6/130604240/ad53c430a.pdf
    • http://fringeparenting.com/uploads/1/3/0/3/130312965/nibaxigisubaga_redupoxuzano.pdf
    • http://stockbroker-fraud-lawyer.com/uploads/1/3/0/2/130272333/1189946.pdf
    • http://mlachomes.com/uploads/1/3/0/7/130738803/814bdb0.pdf
    • http://www.ilmedioevoincucina.com/uploads/1/3/0/4/130483591/516669.pdf
    • http://www.onegirlstakeonmoney.com/uploads/1/3/0/8/130873914/253078.pdf
    • http://deltaixsecurity.com/uploads/1/3/0/5/130539553/2382747.pdf
    • http://my-gama.com/uploads/1/3/0/6/130621908/riwafotiziduj.pdf
    • http://brightgirlbook.com/uploads/1/3/0/5/130550879/3260107.pdf
    • http://www.etherealorder.org/uploads/1/3/0/5/130588443/f4f761e.pdf
    • http://nclexpnprepguide.com/uploads/1/3/0/7/130740206/102465.pdf
    • http://ceremoniousgifts.com/uploads/1/3/0/7/130775766/7049265e6e2.pdf
    • http://jinglebelle.net/uploads/1/3/0/2/130287311/09637a.pdf
    • http://bitterootmontana.com/uploads/1/3/0/8/130874257/mogoguminenix.pdf
    • http://sharingfamilymemories.org/uploads/1/3/0/5/130590578/791ae1.pdf
    • http://davidbaskind.com/uploads/1/3/0/5/130589131/ac739f11.pdf
    • http://dns.mikeaguilera.com/uploads/1/3/0/4/130476605/cb5f09c038e5d4.pdf
    • http://tarasnaumenko.com/uploads/1/3/0/5/130550758/130550758.html#images+of+tribes+of+andaman+and+nicobar+islands

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c29.bin
3e70a1129a968813ec9eeb0d9cc575801e280265601c6ae5b131c4fa7246df6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C29 8360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.