Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b6f2a02fac96882…

MALICIOUS

PDF

38.5 KB Authoring application: ImageMagick
MD5: 946bed544f1003c1020bfb4c1e3824d6 SHA-1: bfab16339ecb0c2e3d4ff9f572eca4caf765592c SHA-256: 1b6f2a02fac968829cda2beb41fa12598a35b7f7a91d57f8e6a085e74779e684
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for phishing or malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mycoloradoorthodontist.com/uploads/1/3/0/7/130740003/dakenofa.pdf
    • http://chantillyescaperoom.com/uploads/1/3/0/6/130604758/6240801.pdf
    • http://andrewgibson.ie/uploads/1/3/0/3/130323253/6488180.pdf
    • http://paintandwinealbuquerque.com/uploads/1/3/0/5/130540882/dixufuto-jofopugowetizez.pdf
    • http://oceannotions.com/uploads/1/3/0/4/130489039/gilosikaweliw.pdf
    • http://www.chaskasiding.com/uploads/1/3/0/7/130739200/wopitove.pdf
    • http://skawennati.org/uploads/1/3/0/4/130435780/birim_nijojezibupo.pdf
    • http://mba-coliving.com/uploads/1/3/0/5/130590105/jadira-muserunoj-pujevubuzol-wamukekuxeg.pdf
    • http://mail.strive4business.co.uk/uploads/1/3/0/6/130604696/goludurigekujokiz.pdf
    • http://nottinghamkickboxing.com/uploads/1/3/0/6/130639385/lurijubigopot.pdf
    • http://donknation.com/uploads/1/3/0/4/130483507/vomipaginebudure.pdf
    • http://inspiredtravelsolutions.net/uploads/1/3/0/2/130270742/ebefca0c7.pdf
    • http://frankhatesyou.org/uploads/1/3/0/2/130272424/8490338.pdf
    • http://anaestheticslondon.com/uploads/1/3/0/4/130483134/70d3acfc.pdf
    • http://mafamillecenla.net/uploads/1/3/0/7/130739525/2084583.pdf
    • http://thetrainingcentre.org/uploads/1/3/0/4/130488197/678f6b.pdf
    • http://web.scadaengine.com/uploads/1/3/0/6/130604311/de60a8.pdf
    • http://coachharrisbiologywebsite.com/uploads/1/3/0/7/130738622/vibotazidax-parako-sefaxu-faguzis.pdf
    • http://baliliveentertainment.com/uploads/1/3/0/5/130589345/zuzonun_selaganugalolan_xeginis_kawakagokiduxof.pdf
    • http://mespinozamen.com/uploads/1/3/0/7/130739561/lanajovego.pdf
    • http://royalinstincts.com/uploads/1/3/0/6/130604109/6000589beaa7.pdf
    • http://www.crwlodge.com/uploads/1/3/0/8/130813497/nutogajizi_toniked.pdf
    • http://acdavisbass.com/uploads/1/3/0/6/130621456/1360597.pdf
    • http://blacklocustpastures.com/uploads/1/3/0/6/130640231/8fdf70f3b3b0775.pdf
    • http://journeylaurel.net/uploads/1/3/0/3/130323374/8805744.pdf
    • http://reasonablewrestling.com/uploads/1/3/0/9/130969391/130969391.html#adrenal+insufficiency+hydrocortisone+dosage
    • http://andrewgibson.ie/uploads/1/3/0/3/130323253/64881

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003390.bin
72f979683af75237d9d17d2fc67148696948cd408e27cf2571a64e76f11c7cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3390 7352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.