Malicious PDF — malware analysis report

Static analysis result for SHA-256 30850f05a35be441…

MALICIOUS

PDF

227.5 KB Authoring application: PDFBox
MD5: 7e8f9884344ae77867af20100db9fc5a SHA-1: 7343934e26b2a3ccc01f8f7ea70022fc721b40ab SHA-256: 30850f05a35be44167c7611d6284b1c9bbabfd571c48c0c53f6dbd3c8204466f
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The document exhibits characteristics of an advance-fee scam, using language related to lotteries, prizes, and parcel delivery to deceive the user. The presence of numerous external URLs, including http://spearheadvison.com/uploads/1/3/0/3/130379305/8866f820.pdf, suggests these are likely used for hosting malicious payloads or further phishing attempts. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the phishing classification.

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://spearheadvison.com/uploads/1/3/0/3/130379305/8866f820.pdf
    • http://hermeticahealing.com/uploads/1/3/0/6/130605078/sores.pdf
    • http://kelsiecabrerayoga.com/uploads/1/3/0/5/130590265/5f391.pdf
    • http://southernparadisecatering.com/uploads/1/3/0/3/130313161/7436117.pdf
    • http://stogna.com/uploads/1/3/0/3/130323952/35a9c880630.pdf
    • http://campfire.benfrem.in/uploads/1/3/0/5/130590363/rijolig-powigofozuxu.pdf
    • http://gostudiom.com/uploads/1/3/0/7/130739614/papujuligu.pdf
    • http://cresslandbythesplash.com/uploads/1/3/0/6/130604166/duwibufa.pdf
    • http://discoveringcostarica.net/uploads/1/3/0/8/130814921/985479.pdf
    • http://mta-sts.mx.immlawcounsel.com/uploads/1/3/0/8/130815013/30b2b43474d27.pdf
    • http://allthingsandre.com/uploads/1/3/0/5/130589998/lurinono_pugabeg.pdf
    • http://powertospeaknaked.com/uploads/1/3/0/5/130550910/kufupe-lakapi-murifenera-nuzofuzimijobo.pdf
    • http://fishtalesoup.com/uploads/1/3/0/2/130272296/2425599.pdf
    • http://bellafurworks.com/uploads/1/3/0/6/130621873/4473683.pdf
    • http://gajon.info/uploads/1/3/0/7/130776644/ee70a0.pdf
    • http://mhernandez.org/uploads/1/3/0/7/130739309/9972159.pdf
    • http://benstroud.com/uploads/1/3/0/7/130739897/b079f.pdf
    • http://matthewsingerucla.com/uploads/1/3/0/4/130477039/7227239.pdf
    • http://x0597057xstreamtravel.xsideas.com/uploads/1/3/0/7/130739686/130739686.html#summary+of+sherlock+holmes+scandal+in+bohemia

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001f46.bin
343fc439fbba6b82936c37e000504bcc95ddf692699587f057422ef63ef1e1fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F46 9252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.