Malicious PDF — malware analysis report

Static analysis result for SHA-256 55515cb19be89b43…

MALICIOUS

PDF

36.3 KB Authoring application: pstoedit
MD5: 7cbb5a51e565afb1bc498a2e949b1944 SHA-1: b3609c098fa02d3edbc6796a385012c8a749ba69 SHA-256: 55515cb19be89b4383399890300ac837795ab9bbd8250b3dcce4ab46670f3059
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The embedded URLs are likely used to redirect users to malicious content or phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.northharbourvets.co.nz/uploads/1/3/0/6/130640067/nawawivude.pdf
    • http://150daily.com/uploads/1/3/0/2/130291822/6429067.pdf
    • http://icupixx.com/uploads/1/3/0/7/130775951/d63de8ce04eda.pdf
    • http://www.havering-atte-bower-cc.co.uk/uploads/1/3/0/2/130289688/3325397.pdf
    • http://factorygeek.com/uploads/1/3/0/4/130476778/wukeboxugiti-mubuk-pororuxo.pdf
    • http://www.the-wild-moon.com/uploads/1/3/0/6/130605471/4c3a845f5d5c710.pdf
    • http://ingenieriadesarrollohumano.com/uploads/1/3/0/7/130775229/sufipekudotafi-pogaz.pdf
    • http://www.tvrepairssheffield.com/uploads/1/3/0/9/130969570/xuvaxena.pdf
    • http://silverliningtechnicalsolutions.com/uploads/1/3/0/3/130323612/lemoji.pdf
    • http://btmamusic.com/uploads/1/3/0/5/130588508/7b727b81f492d.pdf
    • http://www.bremenfamilymartialarts.com/uploads/1/3/0/4/130488700/vaxavatefupula-wixaxariwovoxu-jixuvewe-konanopugere.pdf
    • http://brothersonthespot.com/uploads/1/3/0/3/130379167/eaedb023b49f8d.pdf
    • http://frontporchbakingco.com/uploads/1/3/0/5/130548070/gawabovepi-nureruzibakid-ritawofonasi.pdf
    • http://mightierthanswords.org/uploads/1/3/0/8/130874170/8975982.pdf
    • http://monicajacobsontennessen.com/uploads/1/3/0/4/130488615/gepuxeruruwanafuf.pdf
    • http://madden4ptc.com/uploads/1/3/0/6/130620168/roketuf.pdf
    • http://wmstrategies.net/uploads/1/3/0/7/130738887/130738887.html#awesome+oscillator+divergence+indicator+mq4

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030bc.bin
b34e3038292cbddc0a0f901ac5329dd68e613de6115be016610c412616d29389		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30BC 8196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.