Malicious PDF — malware analysis report

Static analysis result for SHA-256 ada1b0cddee3476b…

MALICIOUS

PDF

138.4 KB Authoring application: Serif PagePlus
MD5: 910561feb05984a74f516353f50cb1fa SHA-1: 6bb2ff0e85980e3d0f84c0f8865c4e73a8b4579d SHA-256: ada1b0cddee3476b046d541bf3fc07ed09abe09d6b6dd2bff4952cc796888a1d
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, forming a link farm, which is a common technique for distributing malicious content or phishing pages. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly indicates that the document's content is designed to trick users into believing they are entitled to a prize or funds, requiring them to take further action, likely by clicking on one of the provided links. The ClamAV detection further confirms the malicious nature of the file.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pugetsoundlawgroup.net/uploads/1/3/0/9/130969438/bubadefezutena_galalijasezoben_zamixawumamap_fataganegelin.pdf
    • http://brandnamewellness.com/uploads/1/3/0/6/130604192/sijozog_dutotove.pdf
    • http://nickandgraceguy.com/uploads/1/3/0/2/130288419/sirasatesedibit-zukomesef.pdf
    • http://blakeyhastings.com/uploads/1/3/0/4/130435962/b5fb31dd.pdf
    • http://alyssavegerphotography.com/uploads/1/3/0/7/130776607/a54c58f6903.pdf
    • http://sculpsurepittsburgh.info/uploads/1/3/0/5/130543020/wetomika-bifiv-pitafup.pdf
    • http://buy-fedex.com/uploads/1/3/0/5/130542831/kurodukul_wavisu_bidarax_bulifire.pdf
    • http://webmail.stuarts2gabon.com/uploads/1/3/0/5/130543813/8912408.pdf
    • http://www.worldspiritualpower.com/uploads/1/3/0/5/130551405/8933418.pdf
    • http://www.oneeastpaloalto.org/uploads/1/3/0/6/130604446/xideze_lekinavedozibex.pdf
    • http://nativeuniques.com/uploads/1/3/0/5/130588790/ruxik.pdf
    • http://ukdiamondlab.com/uploads/1/3/0/6/130621717/c83f5b3.pdf
    • http://project58serve.org/uploads/1/3/0/5/130546024/3475305.pdf
    • http://gemdes.space/uploads/1/3/0/6/130603979/4290316.pdf
    • http://nmtitlesolutions.com/uploads/1/3/0/2/130270906/retejukuripazef-liroged.pdf
    • http://mystgeorgesrugby.com/uploads/1/3/0/5/130543848/011f70461304.pdf
    • http://tramontanafv.com/uploads/1/3/0/3/130379226/zapimipeman_nufekotamasawo_fukutumetigof.pdf
    • http://nstrajectory.org/uploads/1/3/0/4/130488399/7570d278d106c.pdf
    • http://mlotero.net/uploads/1/3/0/6/130604320/1e048ede9650ad9.pdf
    • http://tch318journals.com/uploads/1/3/0/4/130436006/zetorafivabiw-jimijujinemijix.pdf
    • http://my-genuine-life.com/uploads/1/3/0/7/130739423/laxifowosin.pdf
    • http://adsl-63-204-18-31.benefitplans.org/uploads/1/3/0/8/130814390/130814390.html#2018+fifa+world+cup+match+list+pdf
    • http://sculpsurepittsburgh.info/uploads/1/3/0/5/1305

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001b74.bin
e6651dfbee29d25a27b6069ba8c0823ce70f855b29414a55c76c323b702355a5
pdf-font-stream PDF embedded font (sfnt) at offset 0x1B74 17104 bytes
font_01_sfnt_off0001e8e3.bin
7863b829de04ea8b7f5be4d5dae43fa62182e7611f0c3a300d10b316d27db496
pdf-font-stream PDF embedded font (sfnt) at offset 0x1E8E3 2732 bytes