Malicious PDF — malware analysis report

Static analysis result for SHA-256 3488f73d5fde8b18…

MALICIOUS

PDF

33.1 KB Authoring application: Soda PDF
MD5: 478baee4c3eb51183d8d69da84415c4b SHA-1: f409331ac06251b5f148350082e1138f26023321 SHA-256: 3488f73d5fde8b18586a7de0107011cf1ea43437fbd2400132164ddc43fccffd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. The document body, though partially corrupted, contains references to 'Airplane boarding pass invitation template', suggesting a lure to trick users into clicking the numerous provided links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nexoclean.com/uploads/1/3/0/3/130324136/6419020.pdf
    • http://sheldonxink.com/uploads/1/3/0/4/130483510/488472.pdf
    • http://3mfarmandranch.com/uploads/1/3/0/6/130639791/6101699.pdf
    • http://pieceofmindproject.com/uploads/1/3/0/7/130775828/080cda34bd.pdf
    • http://cafefresco48.com/uploads/1/3/0/7/130776821/vekimag.pdf
    • http://myturkishcoffee.com/uploads/1/3/0/2/130274370/durojud.pdf
    • http://bayareasofareviews.com/uploads/1/3/0/3/130313235/kamosu.pdf
    • http://keplex.us/uploads/1/3/0/6/130603918/a52eef.pdf
    • http://hostmaster.kreativefutures.co.uk/uploads/1/3/0/3/130313173/laparukumemelap.pdf
    • http://cabinetmakersipswich.com.au/uploads/1/3/0/4/130436204/rarevivoxolapuguke.pdf
    • http://recallcathy.com/uploads/1/3/0/6/130621557/xapidupoludapekaw.pdf
    • http://donovanhendrick.com/uploads/1/3/0/6/130621036/8271999.pdf
    • http://buildtheyoungbench.com/uploads/1/3/0/8/130814070/lobad.pdf
    • http://jambosbarbequeshack.com/uploads/1/3/0/6/130604993/909994.pdf
    • http://www.policetrailer.com/uploads/1/3/0/6/130621195/130621195.html#airplane+boarding+pass+invitation+template

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ad3.bin
8168c5881ab0ff269f8ace90fd42bb392e62c5a13107136092be6bfb0e7a2a87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2AD3 6700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.