Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7517517215da240…

MALICIOUS

PDF

44.6 KB Authoring application: Poppler-utils
MD5: 5bf89ae1b48b0fa85c5bc6574810a7d0 SHA-1: 614f4c653bf102f2615bd8cf8a6f5dce0e2d37c5 SHA-256: a7517517215da2407d8ed2e5e319d201f9de877b7ce8b3872dcead2f36ac6103
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or redirection-based attack. The embedded URLs likely lead to malicious content or phishing pages. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mycmatro.com/uploads/1/3/0/6/130621193/kesilopalef_xonafomad_nurabinegafadi_riwizigexudufux.pdf
    • http://kinzerfarms.com/uploads/1/3/0/7/130739210/talisaka_pogep_fezunup.pdf
    • http://pagice.com/uploads/1/3/0/3/130313613/bidapezu.pdf
    • http://fairfaxescaperoom.com/uploads/1/3/0/6/130604181/luwenabutojifa.pdf
    • http://shanandlousayido.com/uploads/1/3/0/8/130813586/nuwirodisededujimibe.pdf
    • http://cosysock.club/uploads/1/3/0/8/130814782/diwezaxawuzede.pdf
    • http://whistleblowerrecovery.com/uploads/1/3/0/6/130620389/6542402.pdf
    • http://christhecopywriter.com.au/uploads/1/3/0/9/130968917/4512936.pdf
    • http://abullfrogstudio.com/uploads/1/3/0/7/130775427/wudalabopor_tasos_potifajirowepug.pdf
    • http://mail.petoskeymuseum.org/uploads/1/3/0/3/130323814/c08c4bd4.pdf
    • http://acloudsolutionsarchitect.com/uploads/1/3/0/2/130288757/10fe25.pdf
    • http://art8light.com/uploads/1/3/0/6/130604299/dotosotiw.pdf
    • http://baserlawprogram.com/uploads/1/3/0/6/130639978/01a62.pdf
    • http://bridgepointsearch.com/uploads/1/3/0/8/130813521/3c69d.pdf
    • http://www.mikecorbettdesign.com/uploads/1/3/0/5/130545485/vulavuniv_sotobekepeta.pdf
    • http://limo-austin.net/uploads/1/3/0/2/130289550/lamuviwatezi.pdf
    • http://springcreekranchclublambs.com/uploads/1/3/0/5/130590353/7234209.pdf
    • http://ocfertilitycare.com/uploads/1/3/0/3/130379529/9372308.pdf
    • http://villannabella.com/uploads/1/3/0/3/130323157/dipavafuwafibiw.pdf
    • http://redriverrolloff.com/uploads/1/3/0/4/130488165/1720960.pdf
    • http://caddielands.com/uploads/1/3/0/5/130588473/zewipabever.pdf
    • http://7pryo.bpmtc.com/uploads/1/3/0/6/130604203/130604203.html#animal+life+worksheet+for+grade+2
    • http://art8light.c

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034f2.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34F2 16036 bytes
font_01_sfnt_off00004c2d.bin
f90434a9688d5c800eb93087a758bb7fc9e88e24c4639586136fc0295e0eeee5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C2D 8456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.