Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9c22f30eb1bb8b5…

MALICIOUS

PDF

38.7 KB Authoring application: Soda PDF
MD5: 6733ef9b6f303a43ff645cf0aea799a4 SHA-1: 814eb32c102ae5976bd8bef9d497291bcf4970c6 SHA-256: f9c22f30eb1bb8b56b1eee1992307bd8ca1938ca7e1a411344cdd365abe3fe75
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection intent. The document body, though heavily obfuscated, contains text related to 'kidney failure', potentially a lure for a health-related scam.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ritualcoffeebar.com/uploads/1/3/0/6/130605072/mijeligawiwek.pdf
    • http://nancyrichy.com/uploads/1/3/0/7/130775370/4371615.pdf
    • http://mypowdercoat.com/uploads/1/3/0/7/130776268/8969215.pdf
    • http://www.riccifitness.com/uploads/1/3/0/2/130287976/d101623ee5.pdf
    • http://ulessor.com/uploads/1/3/0/6/130640191/2736546.pdf
    • http://sofiyacattery.nl/uploads/1/3/0/4/130491001/gixutuxom.pdf
    • http://myvegandish.com/uploads/1/3/0/2/130289410/kivotigupofagulowavu.pdf
    • http://northeastfjord.com/uploads/1/3/0/3/130379291/wetazowedaxigiluzovo.pdf
    • http://cambiatucasa.com/uploads/1/3/0/4/130489649/jigebizumiligu_jowireme.pdf
    • http://www.ebenezermemorials.com/uploads/1/3/0/5/130588942/zufapemavajavigozupu.pdf
    • http://tomakeandtobe.com/uploads/1/3/0/6/130620947/1307172.pdf
    • http://abovethecloudsaviation.com/uploads/1/3/0/2/130272247/2526314.pdf
    • http://piinttheskyflorida.org/uploads/1/3/0/7/130739607/945295.pdf
    • http://mta-sts.httpsgomagiccarpet.voyagerwebsites.com/uploads/1/3/0/2/130272332/130272332.html#cure+kidney+failure+in+dog
    • http://ritualcoffeebar.co

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e1d.bin
ff3cec3df73f5d2998a66cf35fc1cfb960892448bbfc64e76f01d9183737ef3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E1D 8076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.