Malicious PDF — malware analysis report

Static analysis result for SHA-256 45f5bb7d4b788bce…

MALICIOUS

PDF

29.9 KB Authoring application: PDFBox
MD5: 71fb91d671d2d7786fa9df230b02d1c2 SHA-1: 8652f19315b4c16b0f37f28f1a62d492d823a100 SHA-256: 45f5bb7d4b788bce9a9872c06a6c2ee42726d3ad3bb834296c0e16b297e56275
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm designed to distribute malicious content or conduct phishing attacks. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment. No scripts were extracted from this sample, but the extensive link farm suggests a delivery mechanism for further stages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tntstasteepastrees.com/uploads/1/3/0/6/130621444/ralobitotavel_fefarewite_gujegudax_xazimaxi.pdf
    • http://www.vikkilutton.com/uploads/1/3/0/4/130435786/1258252.pdf
    • http://bbtreeservice.net/uploads/1/3/0/6/130640029/geginogu.pdf
    • http://www.mikesingroundpools.com/uploads/1/3/0/6/130639611/zinuguzabinuse.pdf
    • http://masterpeacepress.com/uploads/1/3/0/8/130814246/lumulonipilidefome.pdf
    • http://bandmcrushers.com/uploads/1/3/0/3/130379362/menegosav_vumavego.pdf
    • http://realtyrenovation.net/uploads/1/3/0/7/130775087/9984218.pdf
    • http://mobileautorepairsolutions.com/uploads/1/3/0/5/130588733/maleka.pdf
    • http://maisonbouche.net/uploads/1/3/0/6/130604884/favizimos.pdf
    • http://mx.shopandcarry.com/uploads/1/3/0/8/130874021/315616.pdf
    • http://stand2serve.org/uploads/1/3/0/4/130488831/3172113.pdf
    • http://crrc.website/uploads/1/3/0/7/130776176/6987458.pdf
    • http://primpeffect.com/uploads/1/3/0/2/130289682/dupurerowemame.pdf
    • http://thegundamheroes.com/uploads/1/3/0/8/130813953/5348380.pdf
    • http://dominicspizzeria.net/uploads/1/3/0/2/130291328/130291328.html#entity+framework+7+tutorial+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001d18.bin
0d4f7652491eb64634d3e4f679d2ca1a780029e11ff0b0969517019968de7150		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D18 7092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.