Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b46cdb0293b0da4…

MALICIOUS

PDF

130.4 KB Authoring application: Adobe PDF Library 9.0
MD5: d05864f620cbccda938c59a9f295918e SHA-1: 67e7f0b8fa19d03db34d5248b3d5ad3016007099 SHA-256: 3b46cdb0293b0da484a6bfd5e9257a101b16c24d15cd9f0d068f75f1402e17b5
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files, a technique often used to inflate search engine rankings or redirect users to malicious sites. The document body and heuristic firings indicate an advance-fee scam lure, suggesting the user is being tricked into believing they have won a prize or are due a large sum of money. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports the malicious nature of the file.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://avalanchebruidsboeketten.nl/uploads/1/3/0/5/130544591/297925.pdf
    • http://naturaphysicaltherapy.org/uploads/1/3/0/5/130543402/4032d3d6e7563c6.pdf
    • http://caltempmissionb.org/uploads/1/3/0/2/130288757/1635280.pdf
    • http://zeroxuz.osteopat26.ru/uploads/2020/01/28/6864645.pdf
    • http://testvocabulary.com/uploads/1/3/0/6/130621196/zixadavefiza.pdf
    • http://mysoundcollective.com/uploads/1/3/0/6/130640048/130640048.html#fifa+world+cup+2018+germany+next+match

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014e0.bin
19ab6925eea3354f134e9bc5dc261ff2537e1a659c746dba4f1460bd5ef4f6df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14E0 16948 bytes
font_01_sfnt_off0001c9d3.bin
7863b829de04ea8b7f5be4d5dae43fa62182e7611f0c3a300d10b316d27db496		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C9D3 2732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.