Malicious PDF — malware analysis report

Static analysis result for SHA-256 25e768afbbd1aa54…

MALICIOUS

PDF

1.25 MB Created: 2011-08-08 19:03:19 Authoring application: Microsoft® Office Word 2007 First seen: 2014-04-05
MD5: f6e8a59444b3c444847d8ae260f28eae SHA-1: 340beff0b95835073e8173573ebef8b5d89528ea SHA-256: 25e768afbbd1aa5467562c97528aece8db2dcdfe1005e4ee7f0191bcfae71310
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and exhibits a 'Travel-support phone-number stuffing scam' heuristic, indicating an attempt to deceive users. The document body is filled with links related to computer hardware and technology, likely serving as a lure to disguise the scam. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier clean score 0.0013

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-7096549-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7096549-0
  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cache.gawkerassets.com/assets/images/17/2011/08/71aumzmbxpl._aa1200_.jpg In PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/81r9zripsvl._aa1500_.jpgIn PDF document text
    • http://www.jonnyguru.com/In PDF document text
    • http://extreme.outervision.com/psucalculatorlite.jspIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/neweggreviews.pngIn PDF document text
    • http://frys.com/In PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/step1.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/step25.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/step5.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/step84.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/cablemanagement.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/turniton.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/windowsupdate.pngIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/nxms3x2b_1.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/step2_01.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/step3.jpgIn PDF document text
    • http://cache.gawkerassets.com/assets/images/17/2011/08/step7.jpgIn PDF document text
    • http://ocsp.verisign.com0In extracted file (font_01_sfnt_off000df361.bin)
    • https://www.facebook.com/WhitsonGordonFanPagePDF link annotation
    • https://twitter.com/kindrudekidIn PDF document text
    • http://lifehacker.com/5684015/crafting-the-perfect-computer-spec-listIn PDF document text
    • http://www.newegg.com/Store/SubCategory.aspx?SubCategory=10&name=Desktop-PCsIn PDF document text
    • http://lifehacker.com/5796846/why-clock-speed-doesnt-matter-much-when-comparing-two-computer-processorsIn PDF document text
    • http://lifehacker.com/5570909/how-to-prevent-your-computer-from-overheating-and-why-its-importantIn PDF document text
    • http://lifehacker.com/5580998/a-beginners-guide-to-overclocking-your-intel-processorIn PDF document text
    • http://www.anandtech.com/In PDF document text
    • http://www.anandtech.com/bench/GPU11/188In PDF document text
    • http://www.newegg.com/In PDF document text
    • http://reddit.com/r/buildapcIn PDF document text
    • http://www.tomshardware.com/forum/In PDF document text
    • http://lifehacker.com/openthreadIn PDF document text
    • http://pcpartpicker.com/In PDF document text
    • http://www.youtube.com/watch?v=ERhxmzQR6xAIn PDF document text
    • http://pcsupport.about.com/od/fixtheproblem/tp/ami-beep-codes.htmIn PDF document text
    • http://pcsupport.about.com/od/fixtheproblem/tp/award-beep-codes.htmIn PDF document text
    • http://pcsupport.about.com/od/fixtheproblem/tp/phoenix-beep-codes.htmIn PDF document text
    • http://www.reddit.com/r/buildapcIn PDF document text
    • http://lifehacker.com/5827491/how-to-build-a-computer-from-scratch-lesson-3-building-the-computerIn PDF document text
    • http://lifehacker.com/5778882/getting-started-with-linux-the-complete-guideIn PDF document text
    • http://lifehacker.com/5672051/how-to-build-a-hackintosh-mac-and-install-os-x-in-eight-easy-stepsIn PDF document text
    • http://www.howtogeek.com/howto/the-geek-blog/building-a-new-computer-part-3-setting-it-up/In PDF document text
    • http://lifehacker.com/5826909/lifehacker-pack-for-windows-our-list-of-the-best-windows-downloadsIn PDF document text
    • http://www.tomshardware.com/In PDF document text
    • http://www.anandtech.com/bench/In PDF document text
    • http://www.extremetech.com/In PDF document text
    • http://tinyurl.com/FalconGuideIn PDF document text
    • http://www.youtube.com/user/NCIXcomIn PDF document text
    • http://www.youtube.com/user/linustechtipsIn PDF document text
    • http://www.youtube.com/watch?v=FK4ip08auGgIn PDF document text
    • http://lifehacker.com/5828286/tonymacx86.blogspot.comIn PDF document text
    +27 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_014_off0004a5ed.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4A5ED 213300 bytes
SHA-256: e07c2eb39075a40a70ce966f113976bc719d732347857bf0dad07f2478ff72a4
stream_046_off000f498a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF498A 197488 bytes
SHA-256: 66e38c40aa93c3566a91324c82bd15fa3570ad541822a2e95e86bbc5322dfdfb
font_00_sfnt_off000d4d83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4D83 179616 bytes
SHA-256: 4b12728027a1b16bf9abd7dd562e54699de33173701ee4c5579bce525fe2bb79
font_01_sfnt_off000df361.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF361 23148 bytes
SHA-256: 0b3442a5dcced2030300296a2148b0268e2c3b7f9da43b270d9146a79b0cbfd3
font_02_sfnt_off000e1f4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1F4D 162420 bytes
SHA-256: 5df3409283072643e412eabae9b27dc391ff94c82665adb331e50023c32af73b
font_04_sfnt_off0010b847.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B847 169604 bytes
SHA-256: 43dc4a47cd15a75d440702ccad7c6eb327945deaff94a2751018861019c55887
font_05_sfnt_off0011e68b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E68B 56804 bytes
SHA-256: 15edbd3d172a16892dd83b7e90da0fd4fe04b430044012f42794d2fcdfd59297
font_06_sfnt_off00124a67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124A67 172428 bytes
SHA-256: 846c5fdb95faa636fdd87afbea05ad5e4fd4a82eaa6ee89b9c67af3f2756b14a

Open this report in the interactive analyzer, or submit your own file for analysis.