Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0ed4dd16d808223…

MALICIOUS

PDF

40.1 KB Authoring application: Poppler-utils
MD5: 91ba08c6edbe7582f2e848480c7566e4 SHA-1: 6ee297212569c6c8c979364ff7c1c495cff60d8f SHA-256: b0ed4dd16d8082233a399a38d0295f53dc91c6e27b024202e5bf02e1e8e991c2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm designed to drive traffic to potentially malicious sites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kristylewis.fish/uploads/1/3/0/7/130739194/8451764.pdf
    • http://moscowshamrocks.com/uploads/1/3/0/4/130488888/lexit.pdf
    • http://goodguysmovie.net/uploads/1/3/0/2/130272500/1846414.pdf
    • http://bradleypwright.com/uploads/1/3/0/7/130739070/zededim.pdf
    • http://cpanel.cudow.com/uploads/1/3/0/7/130776325/bc762649bc4.pdf
    • http://cawsandcottages.co.uk/uploads/1/3/0/8/130874543/154bad252d.pdf
    • http://spoutmachines.com/uploads/1/3/0/4/130489265/zutimivabaweluwe.pdf
    • http://nataliezinawalschots.net/uploads/1/3/0/4/130488604/6211985.pdf
    • http://mieswholesalemeats.com/uploads/1/3/0/5/130590779/5737282.pdf
    • http://hostmaster.equilibriumtherapy.net/uploads/1/3/0/2/130288579/1520c6.pdf
    • http://noddfw.com/uploads/1/3/0/4/130476778/xukironazodanafo.pdf
    • http://reseautrans.net/uploads/1/3/0/6/130621765/955dd2eecff8.pdf
    • http://tryshashby-rolls.com/uploads/1/3/0/5/130539155/zirabigatu_raxodavavel_mutixakig.pdf
    • http://bodybenefitsbath.com/uploads/1/3/0/6/130639136/02543f0.pdf
    • http://victoriaprofessionalnetwork.com/uploads/1/3/0/7/130776558/653824.pdf
    • http://trinityfitness247.com/uploads/1/3/0/7/130739814/vavijixamaxir-pinuwujif-vogexaj.pdf
    • http://cisna.org/uploads/1/3/0/4/130488661/e7577e3.pdf
    • http://sta-66-99-58-213.ladse.org/uploads/1/3/0/3/130313115/130313115.html#best+nba+draft+combine+results

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000401f.bin
8dfced2a16b8eb6aa586452ac1798ee5e6d2648032f22bfbb22befe551ba1e15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x401F 8096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.