Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b711f22de0cbe89…

MALICIOUS

PDF

40.6 KB Authoring application: PDFedit
MD5: 593de13fb2aed5d61be1de1c3afc7392 SHA-1: d3f2370977539c8b294b8cc9f33fab0ea72dd221 SHA-256: 8b711f22de0cbe8933fd5d9d7a66b1e1ce73b4a8d18bf514a84cbe2f867f731c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The primary URL identified is http://postalmx.com/uploads/1/3/0/2/130272361/gozuxuledilizekuf.pdf, which is part of a link farm designed to direct users to potentially malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://postalmx.com/uploads/1/3/0/2/130272361/gozuxuledilizekuf.pdf
    • http://sc45.weebly.com/uploads/1/3/0/4/130475901/779556.pdf
    • http://dlrichiepainting.com/uploads/1/3/0/4/130488157/perubokam.pdf
    • https://womejaritidawo.weebly.com/uploads/1/3/0/4/130436018/75c9893e1df4f.pdf
    • http://andrespardor.com/uploads/1/3/0/5/130539247/8433273.pdf
    • http://newmomcompany.com/uploads/1/3/0/6/130604388/masas.pdf
    • http://3dactivesports.com/uploads/1/3/0/4/130483270/nezopuxaw.pdf
    • http://hospitalitytechsummit.ie/uploads/1/3/0/2/130288962/6111955.pdf
    • http://newtrailpioneer.com/uploads/1/3/0/5/130590339/6146801.pdf
    • http://mrsroperlsga.weebly.com/uploads/1/3/0/2/130272361/7331fc1f86b66d0.pdf
    • http://youngatheartdesigns.com/uploads/1/3/0/3/130379462/solirogapafan.pdf
    • http://memijo.sell-video.ru/uploads/2020/01/28/5242937.pdf
    • http://pcaregionalconference2019.com/uploads/1/3/0/4/130436196/vepoxutedaginer_jinosotidusel.pdf
    • http://loweslake.com/uploads/1/3/0/6/130621973/7749f73d.pdf
    • http://foren.bootsalebonanza.com/uploads/2020/01/28/ramimudomuras_politoputane.pdf
    • http://alyssacoughenour.com/uploads/1/3/0/6/130639377/dapovojumuj-zimezaxor-wawaw.pdf
    • https://kamowexu.weebly.com/uploads/1/3/0/2/130289530/wativolexusinu.pdf
    • http://nutritioncapecod.com/uploads/1/3/0/6/130640022/sepigolijuximibunuxu.pdf
    • http://slaughterhouseadventure.com/uploads/1/3/0/3/130313272/3656238.pdf
    • http://teamjaime.com/uploads/1/3/0/5/130551832/c143be0c8e2248.pdf
    • http://artm.agency/uploads/1/3/0/5/130540664/zusetalemav_jewofuda_pitato_notewilibisiz.pdf
    • http://xefazap.kunnor.xyz/uploads/2020/01/29/502525.pdf
    • http://mountain-ammo.com/uploads/1/3/0/2/130289765/ad0585127c5.pdf
    • http://5pointauto.com/uploads/1/3/0/2/130289625/130289625.html#exercices+d%27+orthographe+ce1+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001774.bin
b6017d4dd6cbe26eb01165f13e426fcdc6dd02b147be6eb433654451f1ca2aae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1774 9260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.