Malicious PDF — malware analysis report

Static analysis result for SHA-256 a80b3578401522c2…

MALICIOUS

PDF

47.4 KB Authoring application: PDFedit
MD5: 3d4ea46abf2d52287fd62aec968ee4a8 SHA-1: b1e1941b34354604af157e1d3d2988721f4e9329 SHA-256: a80b3578401522c21566571540402aedd27db404d1db6e690d503ac9f76b2119
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file. No scripts were extracted from this sample, and the document body contained mostly garbled text.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.rurrenabaque.org/uploads/1/3/0/4/130483239/lelimurasovubo.pdf
    • http://localenews.com.au/uploads/1/3/0/5/130551140/vaporowenifeti.pdf
    • http://mytrophyprofile.net/uploads/1/3/0/5/130541904/dojefanunixufonare.pdf
    • http://highpotency.com/uploads/1/3/0/4/130476148/a36204d689b8a.pdf
    • http://rochestersportsfan.com/uploads/1/3/0/4/130483963/teroketurizo_gasoz.pdf
    • http://elhtr.com/uploads/1/3/0/6/130620649/xunizawej.pdf
    • http://murphyzcafe.net/uploads/1/3/0/7/130776130/nakupubufijuliz-gutarome-lijazololag.pdf
    • http://optionsincaring.net/uploads/1/3/0/5/130589070/1213031.pdf
    • http://doggiestyles.net/uploads/1/3/0/5/130590555/757553.pdf
    • http://bestflooringco.com/uploads/1/3/0/5/130588954/baxofariwow_gewebinikaz.pdf
    • http://paradeon.net/uploads/1/3/0/4/130435925/figipilogived.pdf
    • http://cvillearchitecture.com/uploads/1/3/0/3/130313091/terorutuvowuzap.pdf
    • http://vacationhomesresorts.com/uploads/1/3/0/4/130476346/zetanijevejek-xiluledit-noxose.pdf
    • http://lippincotts.net/uploads/1/3/0/5/130550830/d620d78.pdf
    • http://www.coloradoteris.com/uploads/1/3/0/9/130969992/terilopubavere.pdf
    • http://74-123-79-94.mgwnet.com/uploads/1/3/0/7/130739043/130739043.html#ask+fsk+psk+qpsk

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048a4.bin
ae01dc6552d56cf048263a41aeda287a07a97756e5f160d372dce52ec2117f40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48A4 1576 bytes
font_01_sfnt_off0000506a.bin
985cbd9ba5b629f1b749d04d852c0eecb5d8ad374186a1044a60da9476420dc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x506A 2788 bytes
font_02_sfnt_off00005d0c.bin
3ca221e651fa4b4476d8d065f081bf043f1c1a161a6002f519606d69efa62572		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D0C 8564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.