Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bc1237904075d77…

MALICIOUS

PDF

36.7 KB Authoring application: Pdftk
MD5: 6133bdec183b52fcb9656825f73ac8f6 SHA-1: 861c2dffbf6b28f870eab73a8adcebfa2d694564 SHA-256: 7bc1237904075d77840cfabba15607ad45f60d859a0550dc7d020bb42a2bd5b9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, which is a common tactic for phishing or distributing malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature. The embedded URLs are likely used to redirect users to malicious sites or download further payloads.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://whatthesaintsknew.org/uploads/1/3/0/5/130551907/wularewafanaj.pdf
    • http://connectthelotscamden.com/uploads/1/3/0/5/130551729/5646567.pdf
    • http://optionthis.ca/uploads/1/3/0/5/130545447/f759b05e3c98ea7.pdf
    • http://meritcardmoapp.com/uploads/1/3/0/5/130545194/904981.pdf
    • http://charlesheinerfiction.com/uploads/1/3/0/4/130483769/2954194.pdf
    • http://rentalandroomate.com/uploads/1/3/0/6/130603936/difatofivowa.pdf
    • http://whiteoutfilms.ca/uploads/1/3/0/5/130539009/5457074.pdf
    • http://dewaynefoote.com/uploads/1/3/0/6/130639683/mijod.pdf
    • http://mentorherbizmembership.com/uploads/1/3/0/3/130379596/5192287.pdf
    • http://debashisdalai.com/uploads/1/3/0/6/130604458/nukosuxaximunef.pdf
    • http://shopfamilyowned.com/uploads/1/3/0/3/130323430/mugozuxo-bugux-gufikegotug.pdf
    • http://ninety-percent.com/uploads/1/3/0/5/130540219/116819f9.pdf
    • http://www.eventsbylora.com/uploads/1/3/0/9/130969953/4912772.pdf
    • http://mustlikeplants.com/uploads/1/3/0/4/130435734/7b2300d3163.pdf
    • http://naturopathsinternational.org/uploads/1/3/0/3/130323656/2a083cac6eb1.pdf
    • http://kadampa.club/uploads/1/3/0/6/130604640/60ccc4e631c0e1c.pdf
    • http://tylarclaypool.com/uploads/1/3/0/5/130590375/5595179.pdf
    • http://hiloic.com/uploads/1/3/0/4/130489536/74dfe4a.pdf
    • http://kandice-baker.pleasingfood.com/uploads/1/3/0/5/130551226/130551226.html#megagen+abutment+torque
    • http://dewaynefoote.com/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fb8.bin
5020559bc1954537ef9268fc1ff71a9fc891e1d309b04cd8df4f3d3879a29517		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FB8 8632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.