Malicious PDF — malware analysis report

Static analysis result for SHA-256 49e435670adf31fd…

MALICIOUS

PDF

42.4 KB Authoring application: pstoedit
MD5: b330aad0b39be0fe33c3496ec756bdcc SHA-1: 8da708e4e5156b5349659126168f12843368627c SHA-256: 49e435670adf31fdf01fe28753c76da6a871f825b4d7c6970d9d681f1747a00a
168 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1204.002 Malicious File

The PDF contains a large number of external links, many pointing to other PDF files, suggesting a link farm or redirection mechanism. The 'SE_CLIPBOARD_COMMAND_LURE' heuristic indicates the document instructs the user to copy and paste content into a command-line interface, a common tactic for executing malicious commands. This likely serves to download and execute a second-stage payload, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://marvelousgraceministries.com/uploads/1/3/0/6/130603858/kumaze.pdf
    • http://mail.rokforcefusion.com/uploads/1/3/0/4/130436180/monome_wokobaral_kosomipefaja_pibibo.pdf
    • http://myentouragemusic.com/uploads/1/3/0/7/130776205/zowawetizopux-pixovode-gufinimozuvide.pdf
    • http://troop115.com/uploads/1/3/0/6/130605331/kisivukade_puxegorevixam_nabifofupev_xepebasevub.pdf
    • http://cubibank.com/uploads/1/3/0/4/130488294/dbb88c.pdf
    • http://mitienditaluu.com/uploads/1/3/0/2/130272918/c7b36.pdf
    • http://hostmaster.torridonlive.com/uploads/1/3/0/9/130969266/1d244.pdf
    • http://biblewordstudy.org/uploads/1/3/0/6/130640231/tununefin.pdf
    • http://mlotero.net/uploads/1/3/0/4/130489696/2416505.pdf
    • http://cyantaeed.com/uploads/1/3/0/2/130271067/b3af2966c.pdf
    • http://whitestonecloud.com/uploads/1/3/0/4/130477039/1794824.pdf
    • http://agilebreeding.com/uploads/1/3/0/8/130874278/4139687.pdf
    • http://theradicallygood.com/uploads/1/3/0/6/130640231/kabimadajofubunojoj.pdf
    • http://newenglandgoodlife.net/uploads/1/3/0/2/130289479/6736717.pdf
    • http://enamelchannel.com/uploads/1/3/0/6/130604896/7999204.pdf
    • http://servereserves.com/uploads/1/3/0/2/130291463/walorixe-negejuroxobufu-wiburexakemep-nagozazimid.pdf
    • http://thisiscontent.org/uploads/1/3/0/5/130540493/domawow.pdf
    • http://notariasociati.com/uploads/1/3/0/6/130604321/6237234.pdf
    • http://gardenialandscapedesign.com/uploads/1/3/0/3/130313415/sovoj.pdf
    • http://www.dragonflytslv.com/uploads/1/3/0/6/130620555/nukizim.pdf
    • http://westsydneyparanormal.org/uploads/1/3/0/8/130874520/7940915.pdf
    • http://www.mariah-senior-po-1.rominastiebenphotography.com/uploads/1/3/0/3/130313453/130313453.html#how+to+install+adobe+reader+in+ubuntu+18.04+64+bit
    • http://whitestonecloud.com/uploads/1/3/0

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000407e.bin
997845d9818eda5251bbb4d76f2a12c1a64d6956bd48c70ed5e1a0c45bf80789		 pdf-font-stream PDF embedded font (sfnt) at offset 0x407E 9552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.