Malicious PDF — malware analysis report

Static analysis result for SHA-256 38b0853e50c8af02…

MALICIOUS

PDF

40.2 KB Authoring application: Mobipocket Creator
MD5: fe83f1701f8e8e0cb80ed7b95550e7a2 SHA-1: 14120f5e3b64a40c129fe13148349ff26e4c4e79 SHA-256: 38b0853e50c8af0278c8f381219bdc7e41694f389ac5dbfb4d05a19f928ce74b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The primary attack pattern involves directing users to a multitude of PDF files hosted on various domains, likely for SEO spam or to distribute further malware. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://naftakw.com/uploads/1/3/0/2/130287211/6654e18.pdf
    • http://idealmedikal.com/uploads/1/3/0/7/130775712/6746512.pdf
    • http://hostmaster.netherfieldinteriors.co.uk/uploads/1/3/0/5/130539442/vilake.pdf
    • http://watermelontees.com/uploads/1/3/0/3/130312925/8e39d94.pdf
    • http://coreenergysolutions.com/uploads/1/3/0/2/130272424/4306274.pdf
    • http://navingulia.info/uploads/1/3/0/6/130639946/muxul-palovofojefudew.pdf
    • http://quickcatclaims.com/uploads/1/3/0/5/130543366/fedimimapuzapukuge.pdf
    • http://www.northeastrhinosmcc.co.uk/uploads/1/3/0/4/130478433/dawunabulananor.pdf
    • http://readsoccer.com/uploads/1/3/0/3/130323485/5779917.pdf
    • http://webdisk.craftyrice.com/uploads/1/3/0/6/130620670/rilebebiwuv-xavas-wisuw-tutodeb.pdf
    • http://bcschools.org/uploads/1/3/0/4/130436213/xikuwi.pdf
    • http://www.myemmaland.com/uploads/1/3/0/7/130776200/vexuparanezewinu.pdf
    • http://gvsmarthome.com/uploads/1/3/0/6/130639973/2301407.pdf
    • http://bridgemanagementservicesllc.com/uploads/1/3/0/4/130476447/misosufuke.pdf
    • http://peppercornstone.com/uploads/1/3/0/2/130272994/9007461.pdf
    • http://gi30q.slpny.com/uploads/1/3/0/6/130621324/130621324.html#abap+for+sap+hana

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ed6.bin
2d5e19fa4f45b2b284ac53693e906ba157c6bc614f5c2b637ee9e1bab8347e4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3ED6 9304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.