Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdaa6916f6f9e754…

MALICIOUS

PDF

39.8 KB Authoring application: PDF Studio
MD5: 8ddda1ade1360a0a1bf98bcb046ef348 SHA-1: fcc919238c2045a0f0fe15e5d5d93dfd674e91fb SHA-256: fdaa6916f6f9e7541e7409ee2ada3d5f1a483e4c99139a256df95f53a3554c74
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded external links, indicating a link farm designed to redirect users to potentially malicious content. The primary URL identified is http://e2biopharma.com/uploads/1/3/0/6/130639911/1f149902.pdf, which is part of this link farm.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://e2biopharma.com/uploads/1/3/0/6/130639911/1f149902.pdf
    • http://softparsavasoft144.weebly.com/uploads/1/3/0/4/130435659/802957.pdf
    • https://silenizukajedo.weebly.com/uploads/1/3/0/5/130538946/8680125.pdf
    • http://carollemonrealtors.com/uploads/1/3/0/3/130313114/4273249.pdf
    • http://theywill2.ca/uploads/1/3/0/6/130604949/gelajanukofidugoli.pdf
    • https://lezugagufa.weebly.com/uploads/1/3/0/4/130476157/vekokedaleka_nesala.pdf
    • http://alixxpartners.com/uploads/1/3/0/5/130543155/3052402.pdf
    • http://thebrandonkeiffershow.net/uploads/1/3/0/3/130312950/xexafotudizub.pdf
    • http://sednin.blog/uploads/1/3/0/4/130436079/wigisuxemaman.pdf
    • http://paulberryhillsgallery.studio/uploads/1/3/0/6/130620890/kikarip.pdf
    • http://10thirtychoir.org/uploads/1/3/0/3/130324419/7942659.pdf
    • http://mourntolight.com/uploads/1/3/0/4/130476555/lunafusukowimut.pdf
    • http://my3girls.blog/uploads/1/3/0/2/130292013/jadoridative.pdf
    • http://avalonbeachpodiatry.com.au/uploads/1/3/0/6/130604150/roremobimaduxezekuw.pdf
    • http://miamilegalcenter.com/uploads/1/3/0/5/130588732/3066399.pdf
    • http://mrstodd.net/uploads/1/3/0/5/130588850/zezunulo-rogawagodusak.pdf
    • http://midwestlightingllc.com/uploads/1/3/0/3/130323996/b3601a8dfe29b.pdf
    • http://dubaidesignsprint.com/uploads/1/3/0/6/130639767/jobufutuzepajajazase.pdf
    • http://maritime-economics.com/uploads/1/3/0/5/130588150/1fd65f92b4d.pdf
    • http://lifeindustries.org/uploads/1/3/0/4/130476452/9ac03ebf69bb.pdf
    • http://fafepizix.pr19.icu/uploads/2020/01/28/1016465.pdf
    • http://cafefresco48.com/uploads/1/3/0/6/130621155/4928582.pdf
    • http://obituar.org/uploads/1/3/0/2/130289763/29debe9e2d61.pdf
    • http://mooiedecoraties.com/uploads/1/3/0/5/130539599/130539599.html#birthday+wishes+images++for+sister
    • http://fafepizix.pr19.icu/uploads/2020/01/28/1016465

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001822.bin
736ca28b69880384a54ca74e4ec1806f0c3c25aa2d84b751b3bab45daa0860c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1822 7664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.