Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe1ddc4212e2f41c…

MALICIOUS

PDF

38.9 KB Authoring application: Smallpdf Desktop
MD5: 60baf3be9e722bbd9f59a6f2a93ba006 SHA-1: a5313d7f3d02d7364669f2e8365598c0d060b028 SHA-256: fe1ddc4212e2f41ca6942533389803065a3f54de3af76f05ea5233c815d2c680
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, each hosting a PDF file with a numeric slug in its path. This pattern suggests a link farm or SEO manipulation tactic, potentially used to distribute malicious content or drive traffic to attacker-controlled sites. The ClamAV detection further supports its malicious nature.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://heybwhatsgood.com/uploads/1/3/0/7/130776413/koxuxusojadabixok.pdf
    • http://woodpekker.club/uploads/1/3/0/4/130477363/jenisoguleraf-famoxivi-xepajesunizew.pdf
    • http://timothybrowndesign.com/uploads/1/3/0/5/130543945/8befd57d5f61.pdf
    • http://interfersolutions.com/uploads/1/3/0/6/130639019/kujozopalopi-suzafilim-zuwapesibiw.pdf
    • http://davidtswamuno.com/uploads/1/3/0/7/130739938/rezavekupera.pdf
    • http://annafriendfilm.com/uploads/1/3/0/6/130621272/f7a097a12bb808.pdf
    • http://apexairsoftus.com/uploads/1/3/0/5/130550986/9e0b9657226e.pdf
    • http://mibfrance.com/uploads/1/3/0/4/130488569/eb50361d4d0.pdf
    • http://aufstehen-gegen-linksfaschismus.org/uploads/1/3/0/6/130640190/kimukonoxavaw.pdf
    • http://mythingoutonjesus.com/uploads/1/3/0/6/130639165/fowajadowedus.pdf
    • http://mychickenman.com/uploads/1/3/0/5/130551935/filesilevav-fozik-mobukiveloz-vewodemakaraxin.pdf
    • http://calciopreviews.com/uploads/1/3/0/7/130739937/5128742.pdf
    • http://almostathirdgrader.com/uploads/1/3/0/7/130738603/a0601d303.pdf
    • http://cakeinaboxco.com/uploads/1/3/0/3/130323151/8a4216d8.pdf
    • http://hungernerve.net/uploads/1/3/0/2/130292089/dumutube-piviren-pevufojaba.pdf
    • http://www.fortheloveofrose.com/uploads/1/3/0/9/130969566/podenomagixape-wimojon-ridegogu.pdf
    • http://annamariecrowhurst.com/uploads/1/3/0/6/130620798/gixidamegekivo.pdf
    • http://evantervetphotography.com/uploads/1/3/0/6/130640062/minodojupituj.pdf
    • http://neeseconstruction.com/uploads/1/3/0/4/130489446/8991693.pdf
    • http://www.dogmassagetoronto.com/uploads/1/3/0/7/130775509/d0b31fc747a62.pdf
    • http://74-123-75-235.mgwnet.com/uploads/1/3/0/5/130588718/130588718.html#despacito+cello+sheet+music+easy

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000036d9.bin
7ca2bc8da8ff51c19ce3dc9c5b18eef4977e687ce76863ec04c241f6f684ef64		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36D9 9076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.