Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb7843730db2e187…

MALICIOUS

PDF

37.5 KB Authoring application: PDFBox
MD5: 499dce854e97d81b4b2df903b0fe405f SHA-1: 92d6b61231150ffeff83d7b07c8e68a7f437c844 SHA-256: fb7843730db2e1873cc0592e3df384c0e2ff3a5205b0c2e7243bcd216b23e3d6
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO poisoning or to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The document body itself appears to be corrupted or malformed, providing no direct clues to the user-facing lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://malone-biology.com/uploads/1/3/0/6/130605292/4904786.pdf
    • http://www.livastra.nl/uploads/1/3/0/4/130436152/matutimidu-xepidiv.pdf
    • http://dedrickenterprises.com/uploads/1/3/0/6/130605339/tipiza-mijuvejedoxav-xixirosu.pdf
    • http://bitmoremarketing.com/uploads/1/3/0/6/130621333/wopebuduse_zekazulis.pdf
    • http://mta-sts.mntcapa.org/uploads/1/3/0/8/130813781/nokafevuk_tejipevenikilal_zubidigeson.pdf
    • http://acot.website/uploads/1/3/0/6/130639714/mumodidopewiguwopewu.pdf
    • http://innparadisekauai.com/uploads/1/3/0/4/130436125/rimetama-sabulureginage-fifixanugapen-bejoxor.pdf
    • http://importeddesignz.com/uploads/1/3/0/5/130590163/be98b6d70045.pdf
    • http://allladderparts.com/uploads/1/3/0/6/130639309/9107198.pdf
    • http://garryandjen.com/uploads/1/3/0/5/130539053/2970144.pdf
    • http://amykamala.com/uploads/1/3/0/5/130541688/pinikurore_ruwezujirinanat_nizuti.pdf
    • http://seaplanediving.com/uploads/1/3/0/8/130874451/5913403.pdf
    • http://jamesmaltus.studio/uploads/1/3/0/6/130604338/9440007.pdf
    • http://goodlandpetcare.com/uploads/1/3/0/6/130639885/dazawufuzufi-bomafusedinodi-fafuzabanimur.pdf
    • http://www.worx-smart.com/uploads/1/3/0/3/130379141/nipupap.pdf
    • http://yourprofessionalheadspace.com/uploads/1/3/0/2/130289658/zatom-pubemaf.pdf
    • http://autonomyjeans.com/uploads/1/3/0/4/130476747/8313670.pdf
    • http://pushthenote.com/uploads/1/3/0/7/130738751/2a3bbc245f.pdf
    • http://aipis-edu.org/uploads/1/3/0/6/130640063/walonivinulejipe.pdf
    • http://sitesurveysmate.net/uploads/1/3/0/5/130544090/wesulesewake.pdf
    • http://mrsac.net/uploads/1/3/0/4/130476065/c7f9865e6bf26.pdf
    • http://misscarladance.org/uploads/1/3/0/6/130620412/vovulomoz.pdf
    • http://www.midlands-cv.com/uploads/1/3/0/5/130545745/8397587.pdf
    • http://marilusdesigns.com/uploads/1/3/0/2/130270903/130270903.html#reading+comprehension+exercises+past+simple+and+past+continuous
    • http://autonomyjeans.com/uploads/1/3/0/4/13

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003119.bin
60581079e3f3260bb5ac375aa647b09bfe570147738aa4b2a3a641927c338308		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3119 7456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.