Malicious PDF — malware analysis report

Static analysis result for SHA-256 f94dbe957f8eb7e9…

MALICIOUS

PDF

34.7 KB Authoring application: Adobe PDF Library 9.0
MD5: 64b5b2314be3d105ed22c4fe294cd0dc SHA-1: 88cab7f3502aef3733228b9fa22174ca6aba2c2a SHA-256: f94dbe957f8eb7e9d03a0a19af700ed82d0a2f9c5070cc99e52dd7af94e32468
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique commonly used for SEO poisoning or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted, but the sheer volume of links suggests a coordinated effort to drive traffic to potentially malicious sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thinkgoal.com/uploads/1/3/0/7/130739922/55111fc.pdf
    • http://evaluatemycase.com/uploads/1/3/0/5/130540814/regusesikora.pdf
    • http://wavesmediagroup.com/uploads/1/3/0/7/130775626/68708.pdf
    • http://mosquitotraps.biz/uploads/1/3/0/5/130589191/sevipom-xidufotoba.pdf
    • http://millionairesclub.biz/uploads/1/3/0/6/130621895/fdb9c1ad53e01c2.pdf
    • http://nutrizionistagiuliaporcu.it/uploads/1/3/0/6/130620990/gulejilufipetijatepo.pdf
    • http://paperboyproductions.net/uploads/1/3/0/5/130539583/9742649.pdf
    • http://greensolutionsprovider.com/uploads/1/3/0/6/130620936/merexutov.pdf
    • http://neneliciouslingerie.com/uploads/1/3/0/7/130740598/pafez.pdf
    • http://www.christianlisker.com/uploads/1/3/0/4/130476981/d5514f9bc755.pdf
    • http://blog.stootie.com/uploads/1/3/0/5/130590481/5700155.pdf
    • http://www.harrisoncthomas.com/uploads/1/3/0/7/130775629/1f806d165deb5f.pdf
    • http://aqulia-urbis.com/uploads/1/3/0/7/130740316/9c256362377.pdf
    • http://www.bulldogpuppyorg.com/uploads/1/3/0/5/130539584/benomije.pdf
    • http://www.ginabugstupperware.com/uploads/1/3/0/7/130738715/5035841.pdf
    • http://danaroberts.com/uploads/1/3/0/6/130621856/xobejivux.pdf
    • http://signaturepropertysolutions.net/uploads/1/3/0/6/130604566/9440807.pdf
    • http://jessicalgervaisbooks.com/uploads/1/3/0/2/130287957/130287957.html#craftsman+10+inch+laser+compound+miter+saw+manual
    • http://www.ginabugstupperware.com/uploads/1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002bad.bin
fdf6c9b144312ef4f1f7ef14afc52acc6f9a4748ac742a816e96322c17cc95df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2BAD 7576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.