Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cffc7432d8b8304…

MALICIOUS

PDF

61.3 KB Authoring application: Poppler-utils
MD5: 476a4f820603e0e46a15f3a7bb4dee1b SHA-1: 6d4025b327301fff2c96943b55434b1586c1c345 SHA-256: 8cffc7432d8b8304ddb3fc646301363048f73e69b01054bdb932691b1f69106d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. This pattern is indicative of a phishing or malware distribution campaign, where the document itself serves as a lure to redirect users to malicious content. The ClamAV detection further supports the malicious classification. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.mail.evanstacythrelfall.com/uploads/1/3/0/4/130476243/9be7522f.pdf
    • http://www.smallbizenergy.com/uploads/1/3/0/8/130814382/rutipozipisesejarub.pdf
    • http://jeffreyvictor.net/uploads/1/3/0/5/130590461/7853705.pdf
    • http://azgolfshow.com/uploads/1/3/0/6/130622011/7943871.pdf
    • http://www.herboristerierenovee.com/uploads/1/3/0/6/130604933/xivuxonil_weboso.pdf
    • http://gracebaptistchurcheden.com/uploads/1/3/0/9/130969492/6909487.pdf
    • http://adagedanceanddrama.com/uploads/1/3/0/7/130775374/3248742.pdf
    • http://mx.thespiralgallery.com/uploads/1/3/0/3/130323178/9381380.pdf
    • http://pairofjacks.net/uploads/1/3/0/8/130874045/7406904.pdf
    • http://openmeadowfarms.com/uploads/1/3/0/7/130739916/8046aca8624.pdf
    • http://surgeryla.com/uploads/1/3/0/7/130776580/7905376.pdf
    • http://redeemernewton.com/uploads/1/3/0/6/130639931/b42620.pdf
    • http://c0171196xstreamtravel.xsideas.com/uploads/1/3/0/2/130272364/130272364.html#carcinoma+ductal+invasivo+significado

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000019cf.bin
09cab218011708f11988169fce744cfe8fc393fff02083d3c6ade3a7feafa0f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19CF 8820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.