Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b1744bb3a6be2f2…

MALICIOUS

PDF

35.2 KB Authoring application: PDFedit
MD5: 66a05a040ad7866b7b3383d2949b08b1 SHA-1: 3f02342ef77a9ddcd30a3895ff0ba292d831194c SHA-256: 8b1744bb3a6be2f2b4b2a3153e38e6ce2691e82fef1a4415f893c781db287338
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning or phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body contains garbled text and references to GTA, which appears to be a lure or obfuscation.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://buildredstone.com/uploads/1/3/0/4/130476493/rawiwakosa.pdf
    • http://sachkiretkaur.com/uploads/1/3/0/6/130621998/674e0207ac799.pdf
    • http://nileshsp.com/uploads/1/3/0/6/130639491/feradet-lutevatu.pdf
    • http://soundanddoctrine.com/uploads/1/3/0/5/130551356/1092531.pdf
    • http://anisaalamia.com/uploads/1/3/0/5/130590435/fimur.pdf
    • http://hoperesidence.org/uploads/1/3/0/8/130813651/jezut-vativalofetagom.pdf
    • http://mta-sts.mx.sanfordfilmfest.com/uploads/1/3/0/7/130774969/fixopali.pdf
    • http://lrg.ky/uploads/1/3/0/5/130540186/tezop-felipo-dugenitafubexa-nofirakulugif.pdf
    • http://rankinloan.com/uploads/1/3/0/7/130739309/wiwokuraliviga.pdf
    • http://plotforsale.net/uploads/1/3/0/2/130287243/8525920.pdf
    • http://nextpathfinance.org/uploads/1/3/0/2/130271063/5d594cd.pdf
    • http://footprinttalentmgmt.com/uploads/1/3/0/4/130483804/1670117.pdf
    • http://alohahairnmakeupbygg.com/uploads/1/3/0/5/130539517/bamowozumev.pdf
    • http://faithlifetv.org/uploads/1/3/0/2/130270894/5c619204ab7.pdf
    • http://christinabeautyparlour.com/uploads/1/3/0/3/130313200/130313200.html#cheat+gta+ps+2+polisi+bodoh
    • http://faithlifetv.o

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030f6.bin
5fe80d246c112d0f9abe3a368921a97f9287e8a3b1c927b4aeaf7aa430f64e35		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30F6 7444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.