Malicious PDF — malware analysis report

Static analysis result for SHA-256 84940863cc521b00…

MALICIOUS

PDF

36.1 KB Authoring application: Pdftk
MD5: 532ffe9c1c75207a67ccdb40437f53da SHA-1: 2c87f2440060cc3f0b69f16206d5450a33265fac SHA-256: 84940863cc521b009ef3c873a66278d398060ff5cc8ac7dd6d1d213036e8cb87
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for PDF_SEO_LINK_FARM, indicating it is designed to host numerous external links. The embedded URLs and the document body text, which mentions 'comment couper un pdf en plusieurs pdf' (how to cut a PDF into several PDFs), suggest a lure to trick users into clicking malicious links. The primary intent appears to be directing users to a collection of other malicious PDFs hosted on various domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vegasjunkmovers.com/uploads/1/3/0/8/130814101/zugiralisumuk-mozuxobepan-bipakonovabexo.pdf
    • http://strwbry.io/uploads/1/3/0/2/130291596/ragejepopuxa-nosizilimake-lopapijevajiv-towuf.pdf
    • http://naruebordin.com/uploads/1/3/0/5/130540567/9251150.pdf
    • http://chillnbeans.com/uploads/1/3/0/2/130288798/27322583f1e21.pdf
    • http://ankezimmermann.ca/uploads/1/3/0/6/130622049/130622049.html#comment+couper+un+pdf+en+plusieurs+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010ee.bin
c7868683ad56ee16997fb832b7a2a2cc541ab170cd770228f9488a5d449116b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EE 9520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.