Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fd42dd8b9a891be…

MALICIOUS

PDF

37.4 KB Authoring application: Adobe PDF Library 9.0
MD5: 74e411f89afe3a9cff7666ef0197d9d2 SHA-1: bf8d81cf86cf9c4a749c9c34c4758367c4ba6402 SHA-256: 9fd42dd8b9a891be6cbc5b151461fea3840c5db7be597acd87bdc58b217410c1
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files, identified as a link farm. This is a common technique used in phishing and SEO poisoning attacks to drive traffic to malicious sites or host further malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jjsgroup.net/uploads/1/3/0/4/130476348/5524031.pdf
    • http://www.landscapeequipmentrentals.com/uploads/1/3/0/6/130604910/619429.pdf
    • http://stageworkslouisiana.com/uploads/1/3/0/6/130621425/7ce863dd.pdf
    • http://divinedesign.biz/uploads/1/3/0/4/130483285/716f6e47f010d3.pdf
    • http://languageofrecovery.us/uploads/1/3/0/4/130490808/xuxula.pdf
    • http://yearsofadventures.com/uploads/1/3/0/3/130324037/laduwe-dilazimofatavin-kawetoweje.pdf
    • http://jeepish.net/uploads/1/3/0/6/130639233/likavedoditalopi.pdf
    • http://thewardrobesquad.com/uploads/1/3/0/3/130323120/dutodi-wuliko-wutep-jagexapofu.pdf
    • http://campprepare.com/uploads/1/3/0/5/130551091/pogubedexabe_lubenixotut_pasojalekofenes.pdf
    • http://marcelastraub.com/uploads/1/3/0/3/130323424/07722871a6d.pdf
    • http://mostafaelbaba.net/uploads/1/3/0/8/130814382/leripuzazanalelukejo.pdf
    • http://dmdhomes.net/uploads/1/3/0/4/130436285/vipojatuf.pdf
    • http://minimalteacher.com/uploads/1/3/0/6/130621191/8a1852fc.pdf
    • http://occasionsbygigi.com.au/uploads/1/3/0/7/130776266/bufibevolapogef_xazivekojaxixiv.pdf
    • http://befreetherapy.com/uploads/1/3/0/8/130874473/130874473.html#bass+guitar+c+major+pentatonic+scale

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000037ed.bin
2463bc6b3d0df864aa98e6d8086c06ecd77ff77c66329c109b9976544d2a4c77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x37ED 7924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.