Malicious PDF — malware analysis report

Static analysis result for SHA-256 384bded9be84d3f3…

MALICIOUS

PDF

32.1 KB Authoring application: PDFBox
MD5: 9641b8dcccb5db55a664c7bb9e41eba1 SHA-1: 55cde3a579a526679679ba8249b9eb1a62a32dbb SHA-256: 384bded9be84d3f3d64f1614458d3b65fe97f424e611d2e34352b5b7920907b3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a traffic redirection or phishing scheme. The ClamAV detection of Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the malicious intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nataliereneesteffen.org/uploads/1/3/0/4/130435959/810167.pdf
    • http://redbackelectrical.com/uploads/1/3/0/5/130539249/2061362.pdf
    • http://brecht.holyrood-drama.com/uploads/1/3/0/7/130775372/2854076.pdf
    • http://sweetliving.net/uploads/1/3/0/5/130590122/rotuxobalomibur.pdf
    • http://engageandexperience.co.uk/uploads/1/3/0/6/130605190/c176f.pdf
    • http://mynaturalplace.org/uploads/1/3/0/3/130313274/tojojerinuzefam.pdf
    • http://blackrockms.com/uploads/1/3/0/7/130775702/fevivovexilaz.pdf
    • http://mylsathouse.com/uploads/1/3/0/6/130621665/541752.pdf
    • http://newbritainlimecement.net/uploads/1/3/0/7/130740338/8171749.pdf
    • http://nearfieldeffects.com/uploads/1/3/0/6/130621841/d7c88c8b0d3430.pdf
    • http://www.sevendi.ca/uploads/1/3/0/6/130639665/435646.pdf
    • http://greatsaltlakephotography.com/uploads/1/3/0/6/130604467/nabuxino_ririjutatu_jomuse_zitawanetegate.pdf
    • http://adsl-63-204-18-54.benefitplans.org/uploads/1/3/0/5/130588784/130588784.html#solving+equations+with+fractions+worksheet+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000278b.bin
64448818e20c404a22098bf5d6c6e970edfa148a5c5b5a48b7e89e9197ab06f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x278B 7028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.