Malicious PDF — malware analysis report

Static analysis result for SHA-256 2774bc583eca7f8e…

MALICIOUS

PDF

50.1 KB Authoring application: PDFBox
MD5: 3b27841d48a779485fc94c864f712219 SHA-1: cbdbc81d6e0e854c0617027fcf3717c4d0440673 SHA-256: 2774bc583eca7f8ed5f8a3ec7cffdb0f3fa67bc9170bc4b65c2bdd3d68d55e9a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a technique commonly used for SEO poisoning or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body, though heavily obfuscated, contains references to insurance companies, potentially as a lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://manorbedandbreakfast.com/uploads/1/3/0/2/130287289/fixipuperozal_vejimofupodo.pdf
    • http://basiccomputertutoring.com/uploads/1/3/0/6/130605332/waborul.pdf
    • http://takeawalkwithme.org/uploads/1/3/0/2/130271153/6006193.pdf
    • http://www.1417.rpjandco.com/uploads/1/3/0/8/130874197/wefavajitebuk-deluro-gubigiki.pdf
    • http://blogalytix.com/uploads/1/3/0/5/130538922/906263.pdf
    • http://dimensionalfinancialservices.com/uploads/1/3/0/7/130740242/8050100.pdf
    • http://forex.johndixson.biz/uploads/1/3/0/4/130436299/e3a7614f5b.pdf
    • http://www.spclegacy.org/uploads/1/3/0/7/130738506/7832895.pdf
    • http://emilysdoulaservice.com/uploads/1/3/0/7/130776063/pudifewakete.pdf
    • http://mycccamp.com/uploads/1/3/0/3/130312971/3586863.pdf
    • http://fitnesswithjanelle.com/uploads/1/3/0/5/130545818/newefutijeniwu_sijuwenogokup.pdf
    • http://hiddenpondstables.com/uploads/1/3/0/3/130313271/vumulogi.pdf
    • http://susanfeltonortonsnest.com/uploads/1/3/0/6/130639728/wemumode.pdf
    • http://humansforlife.org/uploads/1/3/0/4/130483236/20d97.pdf
    • http://ylanaphotography.com/uploads/1/3/0/6/130620326/7756483.pdf
    • http://improveed.org/uploads/1/3/0/4/130435717/2093913.pdf
    • http://belindawabelo.com/uploads/1/3/0/7/130775979/razusubefaputa.pdf
    • http://christiandevlin.com/uploads/1/3/0/7/130740340/a527f.pdf
    • http://copefund.org/uploads/1/3/0/7/130776715/2953956.pdf
    • http://dp360crrn.com/uploads/1/3/0/5/130543976/zavarulesujuw-naragiwowavef-mosikejubopiviw.pdf
    • http://doyouevenstrategybro.com/uploads/1/3/0/6/130605357/noporezufesori-zujupemix.pdf
    • http://saveourshrooms.org/uploads/1/3/0/6/130604152/fba4bce276.pdf
    • http://msptohumboldtproducts.com/uploads/1/3/0/7/130738675/f5925297.pdf
    • http://thekittendoodle.com/uploads/1/3/0/5/130588277/kagujitorofuwum_rijomovu_pununule.pdf
    • http://sta-66-99-58-203.ladse.org/uploads/1/3/0/5/130589050/130589050.html#bajaj+allianz+general+insurance+company+limited+policy+renewal

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004702.bin
45c39c4315a5d00962143d4102937301eb2649728d6de39b959633cfc30365c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4702 16144 bytes
font_01_sfnt_off00005ef0.bin
31d5749193f0426ea1ed0f563848558566191bc043a955f5df60f48fbe0dc313		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EF0 8568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.