Malicious PDF — malware analysis report

Static analysis result for SHA-256 977401b4a15db1cd…

MALICIOUS

PDF

51.9 KB Authoring application: Adobe PDF Library 9.0
MD5: 47321f05faa19055db6392f074e59547 SHA-1: 1ce0a46b7a72f042ba890ef2153b66134ea40b53 SHA-256: 977401b4a15db1cda3eb3bbe69f13cc5a1d4c1a092f6e3a2b9e234cd0c560ae5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to other PDF files, a technique commonly used for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the immediate payload.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gtbcf.org/uploads/1/3/0/7/130739504/timup-govizovenuriwod.pdf
    • http://sunnieinternational.com/uploads/1/3/0/9/130969921/433aa30fef.pdf
    • http://insightosteopathic.net/uploads/1/3/0/2/130291371/fd40eb0.pdf
    • http://americanfamilygolf.us/uploads/1/3/0/5/130551962/regonabaf.pdf
    • http://adrianbyrdcounseling.com/uploads/1/3/0/5/130551362/1614332.pdf
    • http://www.artisitisart.com/uploads/1/3/0/5/130542991/kowora.pdf
    • http://www.jillskupinburkholder.com/uploads/1/3/0/4/130476744/8328647.pdf
    • http://www.livingsimplymodest.com/uploads/1/3/0/2/130289225/3502341.pdf
    • http://www.masjid-e-falah.com/uploads/1/3/0/9/130969740/95946e6381fce.pdf
    • http://holypost.us/uploads/1/3/0/8/130814248/3428525.pdf
    • http://trailerrepairrichmond.com/uploads/1/3/0/5/130539218/3011359.pdf
    • http://www.windwardbc.com/uploads/1/3/0/3/130313087/wanofupun.pdf
    • http://www.kasmimi.com/uploads/1/3/0/4/130477605/barisegejal.pdf
    • http://noisecancelling.net/uploads/1/3/0/5/130551836/zapekixijaluduw.pdf
    • http://labellainteriorsvenice.com/uploads/1/3/0/9/130969366/betaperevidaveda.pdf
    • http://tuembarca.net/uploads/1/3/0/7/130775951/podajopibenutoriz.pdf
    • http://mikemythphotography.com/uploads/1/3/0/6/130604320/3081782.pdf
    • http://mjsconstructionllc.com/uploads/1/3/0/5/130539479/130539479.html#all+mathematical+formulas+pdf+free+download

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b9f.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B9F 1388 bytes
font_01_sfnt_off00004541.bin
ce7dee3cfa6469f3821692305e480236d580ec61724e0ce62a4699de8d278163		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4541 13996 bytes
font_02_sfnt_off00006d25.bin
fb9bce3633db7318266924cac50d42efce8eaeaa6b86e096922bb09a3a58b967		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D25 8496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.