Malicious PDF — malware analysis report

Static analysis result for SHA-256 421ba7a2c4f7831a…

MALICIOUS

PDF

33.0 KB Authoring application: Poppler-utils
MD5: 445443b8fa60d0ef42f6e5f8f4350ac9 SHA-1: 8c319e1533b643f61cd1b08b77063c6c4fd53a2d SHA-256: 421ba7a2c4f7831ad42a88bae8f6498021db9f7e8b88017999c8d519d996504d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV heuristic also flags this as 'Pdf.Phishing.TtraffRobotInstall', indicating a phishing or traffic redirection purpose. The document body, though heavily obfuscated, contains references to URLs that are part of this link farm.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://misfitsagony.com/uploads/1/3/0/6/130620782/1fba7f43.pdf
    • http://mrbrownmoderngent.com/uploads/1/3/0/6/130604034/83087b88857e583.pdf
    • http://milegion-legacyrun.org/uploads/1/3/0/6/130621510/sidilekanubove_jilara_kumexuki_fuxixewavofopo.pdf
    • http://myclassicmercedes.com/uploads/1/3/0/6/130605341/zeronaf_wemagakekiwi_guzakusizebebar_bogoz.pdf
    • http://truecorners.com/uploads/1/3/0/6/130621707/2922695.pdf
    • http://myfineswine.com/uploads/1/3/0/5/130590666/6bb20c04d.pdf
    • http://nourishinglynatural.com/uploads/1/3/0/2/130291585/5794aac81b03ca.pdf
    • http://swampersoriginal.com/uploads/1/3/0/2/130272470/3145998.pdf
    • http://morgan-lindsey.com/uploads/1/3/0/4/130483863/movolomujenapixobod.pdf
    • http://nobuhotelmarbella.devsite-1.com/uploads/1/3/0/4/130435990/130435990.html#google+sheet+function+contains

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012bc.bin
f59f6c720e18cde6f37ccabec8bca0885e6594e6cd6500df16c93d7c9c1e9841		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BC 8780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.