Malicious PDF — malware analysis report

Static analysis result for SHA-256 988662e01321278d…

MALICIOUS

PDF

38.8 KB Authoring application: PDFBox
MD5: 7e8f96b56b4efcd2f32482fb90fc7beb SHA-1: 8b106920a695f0a15caef88c79101e626fe8b984 SHA-256: 988662e01321278d5a699d06e09c345ebfc439ad5ec651b11dc5e934fd86c7d1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This technique is commonly used for phishing campaigns or to distribute further malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and traffic redirection nature of this file. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://womenmakegreatart.com/uploads/1/3/0/5/130539810/dabob_pimiwalosuxidef.pdf
    • http://azbasketballcoaches.com/uploads/1/3/0/4/130483279/66af60c.pdf
    • http://keithwardfiction.com/uploads/1/3/0/4/130435978/1771999.pdf
    • http://freescholarships.site/uploads/1/3/0/5/130588650/65da1924d41f.pdf
    • http://marquiis.com/uploads/1/3/0/5/130543057/1071339.pdf
    • http://kiddieslearninghub.com/uploads/1/3/0/2/130270843/6190443.pdf
    • http://mycpfc.net/uploads/1/3/0/7/130775594/dadino.pdf
    • http://themountainforge.com/uploads/1/3/0/5/130590355/151786501c85d.pdf
    • http://designedbynatureinc.com/uploads/1/3/0/7/130775145/dobevagisa_begikikujajina_juwelaladawo.pdf
    • http://mypartypro.net/uploads/1/3/0/8/130873912/vumogaritiwikizu.pdf
    • http://mercedesudaeta.com/uploads/1/3/0/5/130588426/leninuwem.pdf
    • http://northwestfineartstudio.com/uploads/1/3/0/6/130640218/fafawi.pdf
    • http://martayogahome.com/uploads/1/3/0/6/130639538/desudegixeb_sawedusapezigo_vowuv.pdf
    • http://www.monikagodsmark.com/uploads/1/3/0/7/130739002/f7277ff58e1.pdf
    • http://noscopegaming.net/uploads/1/3/0/4/130483821/673122.pdf
    • http://canadausaselect.net/uploads/1/3/0/3/130379074/1559798.pdf
    • http://mta-sts.mail.acmechassisfactory.com/uploads/1/3/0/3/130379074/dexadegus.pdf
    • http://cuttersgolfshop.com/uploads/1/3/0/8/130874608/c72f172b.pdf
    • http://jennifer-rice.com/uploads/1/3/0/7/130738971/3693951.pdf
    • http://ooredooindonesia.net/uploads/1/3/0/6/130605182/302751.pdf
    • http://bshppopup.com/uploads/1/3/0/6/130639549/130639549.html#different+organelles+in+plant+and+animal+cells

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000363c.bin
ffbec40a36416bf41c739fbc5f0f9872fdeab65b5d3ef189c2d611714867e55c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x363C 8624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.