Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7727491f395ab60…

MALICIOUS

PDF

87.0 KB Authoring application: Inkscape
MD5: 03eb46daa149065b445d5c9e7c2ed83f SHA-1: a2ce2b6480293ebfbe9b1b5a6bc280206ad12578 SHA-256: f7727491f395ab60e09aababd198a64e1aff5cd82a6d0cedb3271423af667ad4
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm pointing to numerous PDF files, a technique often used for SEO poisoning or to distribute malicious content. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly indicates the document's purpose is to trick users with a fake lottery or prize notification, a common advance-fee fraud. The ClamAV detection further confirms its malicious nature. The embedded URLs are likely part of this scam, directing users to potentially harmful content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://privasack.com/uploads/1/3/0/3/130323469/lowefenod_mejewetopajun.pdf
    • http://momentumdanceandfit.com/uploads/1/3/0/6/130604568/8589367.pdf
    • http://mail.keramaris.gr/uploads/1/3/0/8/130874635/2592986.pdf
    • http://www.amysanchezbennett.com/uploads/1/3/0/3/130379314/faxab.pdf
    • http://mta-sts.mail.slimacademy.at/uploads/1/3/0/5/130588943/23f50eaf3e4e043.pdf
    • http://mikemooers.com/uploads/1/3/0/6/130639406/tuwonagorigonuze.pdf
    • http://londonsalesagency.com/uploads/1/3/0/6/130605203/8135dd0a.pdf
    • http://animators.directory/uploads/1/3/0/3/130323236/7810729.pdf
    • http://lunchboxcafeny.com/uploads/1/3/0/4/130489157/193afbd561e.pdf
    • http://livingthings.co/uploads/1/3/0/5/130544072/02c39.pdf
    • http://www.kimbescorner.com/uploads/1/3/0/6/130603937/5008232.pdf
    • http://morethanfood.net/uploads/1/3/0/5/130543020/feduvixifaxajow.pdf
    • http://smithandbyford.net/uploads/1/3/0/2/130272506/c83ab.pdf
    • http://thecontactlensinstitute.com/uploads/1/3/0/4/130476873/8679569.pdf
    • http://thesecrettohealthyliving.com/uploads/1/3/0/5/130588515/gosedewejepiperefowu.pdf
    • http://trkscamps101.club/uploads/1/3/0/6/130621437/54d1c6b5df1147.pdf
    • http://cnichollswriting.com/uploads/1/3/0/6/130640183/ripawozowabovub_jadid_wamixafomirorib_vaxedim.pdf
    • http://200jobs.com/uploads/1/3/0/5/130551765/nanolu_guvexomopak.pdf
    • http://mta-sts.jackiedoesntknowcrap.com/uploads/1/3/0/5/130540211/2cd713bec01.pdf
    • http://webmail.stemstil.nl/uploads/1/3/0/5/130540214/3675475.pdf
    • http://nicolasintheoldmarket.com/uploads/1/3/0/7/130775251/devozu.pdf
    • http://dwmfoundation.org/uploads/1/3/0/6/130603943/3937589.pdf
    • http://mombligation.net/uploads/1/3/0/6/130620747/sinogut-nijevipovozebaz-sedukuvimo.pdf
    • http://ripperwebsolutions.com/uploads/1/3/0/4/130491418/746fec61b5.pdf
    • http://chaddock-family.rominastiebenphotography.com/uploads/1/3/0/6/130621481/130621481.html#agency+problem+theory+pdf
    • http://mail.keram

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c14.bin
64fc5b987ea0610707a67d642e28fb4b49a25a1a52df15ef48f73570506e24ee
pdf-font-stream PDF embedded font (sfnt) at offset 0x4C14 9412 bytes
font_01_sfnt_off00011057.bin
b080e6aa9682ff87567a230b404ab00780bafcfd3ba11e3f536b788ca6e08ef5
pdf-font-stream PDF embedded font (sfnt) at offset 0x11057 16060 bytes