Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c13f43bc948cf7f…

MALICIOUS

PDF

44.9 KB Authoring application: ImageMagick
MD5: 42eb299b9b1920926b7529d78184249b SHA-1: 332231ad8e37c4d63b6afd6944406058b41a20c0 SHA-256: 3c13f43bc948cf7fce6a58f4f90735ce60792c8042486cc2dc67bc26cb586e95
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files, a technique commonly used for SEO poisoning or distributing malicious content. The heuristic 'PDF_SEO_LINK_FARM' directly identifies this behavior. Additionally, the 'SE_PASSWORD_ARCHIVE_LURE' heuristic suggests that the document may be intended to trick users into providing passwords for archives, further indicating a malicious intent to bypass security measures. The ClamAV detection confirms the malicious nature of the file.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mesquesabons.com/uploads/1/3/0/6/130640092/vimep.pdf
    • http://mightykidshealth.com/uploads/1/3/0/7/130739032/2947432.pdf
    • http://bugsthathelp.com/uploads/1/3/0/2/130291783/woniju.pdf
    • http://psychotherapeute-paris.net/uploads/1/3/0/8/130874683/0dc80c92c.pdf
    • http://norgrenairregulators.com/uploads/1/3/0/4/130476538/ruporu-xatijine.pdf
    • http://watercraftinspection.com/uploads/1/3/0/7/130740521/6438819.pdf
    • http://nedlittlefield.com/uploads/1/3/0/7/130738969/zefuroperod_rokinidaxom_pexakited_dalunudo.pdf
    • http://shanisofficepreview.com/uploads/1/3/0/8/130813972/8102361.pdf
    • http://www.cascadecrafts.co.uk/uploads/1/3/0/4/130490421/mofupewox-banoxik-guzuwad.pdf
    • http://mbanerds.net/uploads/1/3/0/7/130775366/1976796.pdf
    • http://getbabyskin.com/uploads/1/3/0/6/130639334/purasalomofub.pdf
    • http://platinumprinting.net/uploads/1/3/0/7/130775510/watoxuva.pdf
    • http://trinidadbennett.com/uploads/1/3/0/5/130588954/9b6d1b.pdf
    • http://leadsolo.com/uploads/1/3/0/4/130476944/7343149.pdf
    • http://bvtems.org/uploads/1/3/0/5/130589083/669379.pdf
    • http://1posc.org/uploads/1/3/0/4/130476944/ddf1b80550d.pdf
    • http://marlinjames.net/uploads/1/3/0/7/130738675/zusijajadorus-lavenujigad-tamiwiporije-povazufo.pdf
    • http://rant-therapy.com/uploads/1/3/0/4/130483307/83fd2f135c.pdf
    • http://2017.nordstadjugend.lu/uploads/1/3/0/4/130436313/lolewutolerote.pdf
    • http://dieporzellanklinik.de/uploads/1/3/0/5/130590463/lesomo.pdf
    • http://www.equestrianeliteatapplejackfarm.com/uploads/1/3/0/5/130588346/36a311.pdf
    • http://sanctuaryhomehealthcare.net/uploads/1/3/0/2/130289503/5c8c3c4da.pdf
    • http://stbrendansreds.com/uploads/1/3/0/3/130379182/kixakufusoravam.pdf
    • http://taiyangchengjiawangbaosha.br3h.com/uploads/1/3/0/2/130289213/130289213.html#best+pdf+reader+app+for+iphone

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c05.bin
4c50d74283805edb433fa5a1b712478ee971874695b6b38ac5aad74924bc80be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C05 8440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.