Malicious PDF — malware analysis report

Static analysis result for SHA-256 75fbb871eeec6709…

MALICIOUS

PDF

38.2 KB Authoring application: Soda PDF
MD5: 86ebb36db0e0969b6719cd1281842392 SHA-1: 9edb97900cf414b6c2c6a8fb08a5abaa8e173cd5 SHA-256: 75fbb871eeec670945a4ced4eb9af4a73c9f9c7df2de29b9a29aad51619147ea
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains, indicating a link farm or distribution mechanism. The heuristic 'SE_LOLBIN_RUN_COMMAND' suggests that the document may contain instructions for executing commands using Windows scripting tools, which could be used to download and execute further payloads. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://designjewelry.com/uploads/1/3/0/2/130289284/vubofudenaxuji-kepodizib.pdf
    • http://laserlily.com/uploads/1/3/0/2/130289651/vesiwojiv.pdf
    • http://miacurcargo.com/uploads/1/3/0/3/130323227/7130568.pdf
    • http://firstsucks.com/uploads/1/3/0/5/130543757/df1f5201d2677.pdf
    • http://cmdenterprise.com/uploads/1/3/0/6/130605420/417bc7387.pdf
    • http://nzcarcovers.com/uploads/1/3/0/6/130639678/rolumeni.pdf
    • http://mx.moonessence.com/uploads/1/3/0/7/130776032/weviboza-wozifitixudel.pdf
    • http://atxbeers.com/uploads/1/3/0/3/130323631/2fd78f86fa.pdf
    • http://mmshop.club/uploads/1/3/0/6/130621328/4045119.pdf
    • http://alexislevitan.com/uploads/1/3/0/5/130551927/78b0908d676.pdf
    • http://petcura.net/uploads/1/3/0/5/130589239/17e8664.pdf
    • http://mx.reghanross.com/uploads/1/3/0/5/130539738/rivewoxatike_butigesom_kilupuvaw_xesofutetobulo.pdf
    • http://www.topknotsandmommythoughts.com/uploads/1/3/0/7/130739007/9893405.pdf
    • http://firstollie.org/uploads/1/3/0/2/130287873/wegaretuxek_webafidojabak_resosowefuxev_voxoxijojabi.pdf
    • http://icbrconference.com/uploads/1/3/0/5/130588377/77c10ab1464b8d.pdf
    • http://jamesmcleodvoice.com/uploads/1/3/0/5/130550688/18328bebc228d19.pdf
    • http://www.vanderbilttowers3.com/uploads/1/3/0/3/130313249/guxisevidaxet.pdf
    • http://bilgesgt.org/uploads/1/3/0/8/130874395/9769530.pdf
    • http://voraginedeescritores.com/uploads/1/3/0/3/130379158/gotetu.pdf
    • http://8t2u0.salon225.com/uploads/1/3/0/3/130313718/130313718.html#convert+kindle+in+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000371d.bin
b83634bfe5eeea3e681fb08bef13bc2749e6633d51a29dd93e203d2f5bdb6473		 pdf-font-stream PDF embedded font (sfnt) at offset 0x371D 7908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.