Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2b2fe73f9046ddf…

MALICIOUS

PDF

48.1 KB Authoring application: Pdftk
MD5: 3b1d0893a61d98e79559f8aeef3790f0 SHA-1: a7dbc604b32618da7ed7ea870b5e3c9ed724fbc2 SHA-256: b2b2fe73f9046ddf1f49a793eb09fc156bf57b32c47dcf3d4e17084bc88abd95
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall'. The document body itself is heavily corrupted and unreadable, preventing a more specific analysis of its direct user-facing lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alumark-gerueste.de/uploads/1/3/0/2/130272452/8b8bd37d3b0.pdf
    • http://bikinginrio.com/uploads/1/3/0/7/130775837/02a6e1021383.pdf
    • http://boganreviews.com/uploads/1/3/0/3/130324416/3047362.pdf
    • http://deviseagency.com/uploads/1/3/0/4/130435531/6202616.pdf
    • http://steel-linegroup.com/uploads/1/3/0/5/130550817/ac5552009.pdf
    • http://bunnybeauty.org/uploads/1/3/0/7/130740255/6471237.pdf
    • http://e-learninganddesign.com/uploads/1/3/0/5/130590673/nogimitewid_puxawifumeju.pdf
    • http://myfruitsoflife.net/uploads/1/3/0/7/130776269/gekuketi.pdf
    • http://tenzo.me/uploads/1/3/0/5/130589165/6558992.pdf
    • http://barndoordecor.co/uploads/1/3/0/2/130289294/c4094d.pdf
    • http://insightosteopathic.net/uploads/1/3/0/6/130639227/pugetivab.pdf
    • http://sonyakrakoff.com/uploads/1/3/0/7/130740612/4184427.pdf
    • http://lisamccafferty.com/uploads/1/3/0/7/130739454/5ac51e9b0e4.pdf
    • http://willpowergroup.net/uploads/1/3/0/6/130604229/4e6bd2.pdf
    • http://advanceproductservices.com/uploads/1/3/0/4/130435573/614e692b75ae94d.pdf
    • http://theentitydoctor.com/uploads/1/3/0/4/130488914/ledosedu_munuwumiz_japoxamuvif_vowotixunum.pdf
    • http://carolinabluelady.com/uploads/1/3/0/6/130639950/5c59f5b869.pdf
    • http://paintandwinealbuquerque.com/uploads/1/3/0/6/130621908/kapidasixed_lanakubega_lazebasewijijep_jefirexuno.pdf
    • http://cprsd2.com/uploads/1/3/0/7/130776612/wokawowusasorezo.pdf
    • http://musicanddancecolumbia.net/uploads/1/3/0/2/130272994/vixekewezipo.pdf
    • http://www.miracledigitaladministrations.com/uploads/1/3/0/6/130621030/130621030.html#traumatic+causes+of+cardiac+tamponade

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a89.bin
9cdb1b26189c4637e8312e954a51c1fcadd56d4cfb798ce25281f8d49698b0dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A89 9356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.