Malicious PDF — malware analysis report

Static analysis result for SHA-256 53cc3b2830db2df3…

MALICIOUS

PDF

41.2 KB Authoring application: Mobipocket Creator
MD5: 6e9479a6aa390f13d9bcd5adb335c975 SHA-1: 62bd882b4fb263648e44d702322772d49494f7f4 SHA-256: 53cc3b2830db2df3e7bab681c915f99e6a1777305089cdaf3cb9b632b6b31ea2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a common technique for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body, though heavily obfuscated, contains references to 'Ikea beds with storage malm', suggesting a lure to attract user clicks on the embedded links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://btimsp.com/uploads/1/3/0/2/130289319/lelinawuzud.pdf
    • http://tcoldhamlifesafety.com/uploads/1/3/0/5/130541356/xorigafotepipal.pdf
    • http://allstarroad.com/uploads/1/3/0/8/130814914/rawukiresitufim.pdf
    • http://alamodecollections.com/uploads/1/3/0/6/130605374/xoxokedaxezive.pdf
    • http://lilahbazarte.com/uploads/1/3/0/6/130621510/rukigixopetafi-zigizelezokija.pdf
    • http://stephaniepereira.com/uploads/1/3/0/8/130813496/zomafalujosup.pdf
    • http://garysresume.com/uploads/1/3/0/4/130476650/bajiki.pdf
    • http://chrislockett.com/uploads/1/3/0/7/130739789/2886438.pdf
    • http://www.snowgripit.com/uploads/1/3/0/8/130873877/1245470.pdf
    • http://solardisinfection.org/uploads/1/3/0/4/130483809/b7e6d0a25e22.pdf
    • http://mlhas.com/uploads/1/3/0/2/130272847/dipavuvowawebi-vujos-nutugow.pdf
    • http://orders.carolinamikes.com/uploads/1/3/0/4/130488415/130488415.html#ikea+beds+with+storage+malm
    • http://alamodecollections.com/uploads/1/3/0/6/130605374/xoxokedax

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ca4.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CA4 2616 bytes
font_01_sfnt_off0000486a.bin
befaf0bdb4a7fdd6201011c246ae01674b8a6022bde4f15587d69f464dc9a7f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x486A 8524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.