Malicious PDF — malware analysis report

Static analysis result for SHA-256 20942408579c2e30…

MALICIOUS

PDF

39.5 KB Authoring application: pstoedit
MD5: 489b8c013572d8c231d6257815159983 SHA-1: e2864b09f25f9f554c5757b1e4b68fc259462e1c SHA-256: 20942408579c2e30d739a205f2dd104d8ab7866cab4105996d63f24ecc2cc101
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO poisoning or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample, and the document body content is heavily corrupted, making it difficult to ascertain the exact lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hostmaster.stabotec.ch/uploads/1/3/0/5/130588695/3464349.pdf
    • http://mallsecurity.net/uploads/1/3/0/6/130620353/junaridu-satexaxu.pdf
    • http://automaticpocketdoor.com/uploads/1/3/0/5/130551153/rixafukegi_dirinufilidab_zujopi.pdf
    • http://killerwailslive.com/uploads/1/3/0/3/130379162/5305504.pdf
    • http://triumph-hinckley.no/uploads/1/3/0/2/130272344/19f779f.pdf
    • http://allyourteeth.com/uploads/1/3/0/6/130604982/danaresukux.pdf
    • http://sagadaview.com/uploads/1/3/0/5/130588779/gijirulutevi-sukisoduwafa-zikadutimiju.pdf
    • http://azmendinglives.com/uploads/1/3/0/5/130550982/2596915.pdf
    • http://95defence.com/uploads/1/3/0/3/130379060/5887277.pdf
    • http://cappyphalen.com/uploads/1/3/0/2/130287533/jiwinefukatatomikop.pdf
    • http://jazzysweettreats.net/uploads/1/3/0/3/130323836/wipukuk_bexasalezef_wugovirutu.pdf
    • http://sajaportfolio.com/uploads/1/3/0/6/130605421/wuzun.pdf
    • http://yiechan.com/uploads/1/3/0/7/130739886/pipozudosuvano_nudegapi_doriripefi.pdf
    • http://proaccessinc.com/uploads/1/3/0/5/130551745/3972ce.pdf
    • http://johnsmithuk.com/uploads/1/3/0/5/130538981/rixudanunurer.pdf
    • http://am-pic.com/uploads/1/3/0/2/130287533/98865.pdf
    • http://thesoftearth.com/uploads/1/3/0/5/130546717/perofeme.pdf
    • http://nhlitigators.com/uploads/1/3/0/6/130603819/kidularamefaza_purofomafev_kafibatular.pdf
    • http://project-candle.com/uploads/1/3/0/5/130552106/newirikurigorelib.pdf
    • http://uxguys.mobi/uploads/1/3/0/6/130604402/1641369.pdf
    • http://threedeetwodee.com/uploads/1/3/0/2/130291783/7500838.pdf
    • http://pugetsoundbfw.com/uploads/1/3/0/5/130588267/1d827b684218.pdf
    • http://theapothecaryagency.org/uploads/1/3/0/6/130604413/jolipa_xevuvebaka_rogizupa.pdf
    • http://baylasunhotel.devsite-1.com/uploads/1/3/0/5/130550824/130550824.html#aquaponics+grow+media+south+africa
    • http://johnsmithuk.com/uploads/1/3/0/5/13053898

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003712.bin
3a4163a242e94df31456a84140418caabe8596255e5f80ef9560621f168a7f15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3712 8280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.