Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5948f2107dd06a7…

MALICIOUS

PDF

39.2 KB Authoring application: GIMP
MD5: 4c83d88ac99b6c112cdbe1381e30ff2b SHA-1: 483deef8f3094a04f3a80372dd20170d2fe7018d SHA-256: a5948f2107dd06a799d1cc3ad9973f9634ca7adcfd51c2f02dc014cd5639b3a8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. No scripts were extracted from this sample, limiting the ability to determine specific execution techniques.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://josephsiinoart.com/uploads/1/3/0/5/130550714/fixogem.pdf
    • http://hostmaster.laythedraw.net/uploads/1/3/0/5/130539247/f7db325d42c.pdf
    • http://jlc.press/uploads/1/3/0/4/130483804/jusawu.pdf
    • http://afrisekgroup.com/uploads/1/3/0/6/130640003/lidonidekedel_nisawokiviw_jijumu.pdf
    • http://h2hinteriordesign.com/uploads/1/3/0/3/130379210/f958fd56c0.pdf
    • http://homegrownent.net/uploads/1/3/0/6/130621684/nunogire_lukudivol.pdf
    • http://hotel-tentrem.net/uploads/1/3/0/5/130551192/9094047.pdf
    • http://sharablepost.com/uploads/1/3/0/4/130483757/5433124.pdf
    • http://openglasscockpit.com/uploads/1/3/0/4/130436285/9984405.pdf
    • http://pcfuganda.org/uploads/1/3/0/8/130873976/kijukemop_rozoz.pdf
    • http://create218.org/uploads/1/3/0/4/130489742/zagatugidap_sazuvonapil_mageroxe_dazojinateline.pdf
    • http://mail.franklinvetclinic.com/uploads/1/3/0/3/130379074/lurafenez.pdf
    • http://mydarlingvalentine.com/uploads/1/3/0/7/130775215/wemogoze-jonulivix.pdf
    • http://misfitsagony.com/uploads/1/3/0/6/130604860/bapasarujaduvuk.pdf
    • http://seniorsafeathome.net/uploads/1/3/0/6/130603814/8179098.pdf
    • http://digitalsqueak.com/uploads/1/3/0/2/130272482/ninepukodup-xetiwirifutevow.pdf
    • http://gorapid.365roadsideassist.com.au/uploads/1/3/0/4/130436365/130436365.html#acca+global+p1+past+papers
    • http://h2hinteriordesign.com/uploads/1/3/0/3/130379210/f958

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003cae.bin
a63c46d64e048845e3f293ffec80a243c8c0d25188059b8f94fba8df46143396		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CAE 8184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.