Malicious PDF — malware analysis report

Static analysis result for SHA-256 96d01331d3172ac0…

MALICIOUS

PDF

43.2 KB Authoring application: Soda PDF
MD5: caec12de08de8ca52130978978fba178 SHA-1: 87b4e2480a10eb288ac5541dc701b606f6033f17 SHA-256: 96d01331d3172ac0d0488b0a1f787dc9877b47ab61dccc5b32b401b5db07f3b1
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM', with the primary domain being 'brokersue.com'. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of embedded URLs strongly suggest a phishing or malware distribution campaign. The document body, though partially corrupted, mentions 'Scholarship affidavit format pdf', indicating a lure to entice users to click the malicious links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://brokersue.com/uploads/1/3/0/5/130539427/504f1fd.pdf
    • http://www.1up-products.com/uploads/1/3/0/7/130738831/lanalofakoxaw_fudewanitatil_jetizolidot_zijilepuloz.pdf
    • http://maralynhargrove.com/uploads/1/3/0/7/130739016/292661.pdf
    • http://4prettyhome.com/uploads/1/3/0/4/130489898/5940106.pdf
    • http://perspectivecp.net/uploads/1/3/0/7/130739971/dagusuf_zetexorixelore_vaxitiwo.pdf
    • http://mollymagdalain.com/uploads/1/3/0/5/130588757/tafiwadabuj_xejeta_jenezojujo.pdf
    • http://goldtrucks4sale4x4.com/uploads/1/3/0/8/130873942/8456692.pdf
    • http://khaliafrazier.com/uploads/1/3/0/7/130738607/6603117.pdf
    • http://www.debfosteractress.com/uploads/1/3/0/5/130540176/tezofego_murilotofiw.pdf
    • http://vendingvet.com/uploads/1/3/0/6/130604445/2bf0ef00944.pdf
    • http://www.bossiercityfoundationrepair.com/uploads/1/3/0/9/130969824/5521141.pdf
    • http://christinacarnesphotography.com/uploads/1/3/0/5/130588902/zowomobowemifavukile.pdf
    • http://northwestpetscanning.com/uploads/1/3/0/5/130589427/2370546.pdf
    • http://nshslibrary.org/uploads/1/3/0/7/130739082/moxoxuziwebaw_mewusuxib.pdf
    • http://vintagewoodworkingtools.net/uploads/1/3/0/7/130776185/dibivebalov.pdf
    • http://allamericandoorny.com/uploads/1/3/0/5/130543020/vovazowarefisax.pdf
    • http://naomiwhiteheadtraining.com/uploads/1/3/0/4/130488416/5b7a359eed1a07c.pdf
    • http://lethbridgechristiancounselling.ca/uploads/1/3/0/3/130379743/nobogoziru.pdf
    • http://ttmr8.org/uploads/1/3/0/6/130604689/jizapufug.pdf
    • http://project-black.net/uploads/1/3/0/4/130488395/tabiwetutegugon.pdf
    • http://planaustral.com/uploads/1/3/0/3/130379178/sowagudes.pdf
    • http://host119.carmichaelnl.com/uploads/1/3/0/6/130639941/130639941.html#scholarship+affidavit+format+pdf
    • http://brokersue.com/u

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ed8.bin
7df88723569d4193f530fe437fb919d713328a77de93ba1b94bee14e62ba1f6b
pdf-font-stream PDF embedded font (sfnt) at offset 0x3ED8 1712 bytes
font_01_sfnt_off0000493d.bin
37890faa1ec7dddd4aee085396893b778c0c489b71d95ee2fc509b8c05a85bcd
pdf-font-stream PDF embedded font (sfnt) at offset 0x493D 7536 bytes