Malicious PDF — malware analysis report

Static analysis result for SHA-256 b50d388354ca38e6…

MALICIOUS

PDF

39.3 KB Authoring application: Poppler-utils
MD5: 469376eaa34056b59bf9f49a394b72be SHA-1: 9be9332ccf0cf92c16547838289ec490c70433f5 SHA-256: b50d388354ca38e672c4099ba458f6e3adf0eea8fc239616a0c51a487bd8dd27
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs, forming a link farm. This is indicative of a phishing or malware distribution campaign. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment. The embedded URLs are likely used to redirect users to malicious content or download further malware.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrsparsons.net/uploads/1/3/0/4/130476878/zifezuwus.pdf
    • http://hsexquisitecloset.com/uploads/1/3/0/2/130270918/zedifarawo.pdf
    • http://kris-ginadesigns.com/uploads/1/3/0/6/130621829/pobaxig.pdf
    • http://intraterrestrial.net/uploads/1/3/0/7/130775400/kexuxemorub-rotawas-kedami.pdf
    • http://mermaidicamusic.com/uploads/1/3/0/6/130639762/panomalowe.pdf
    • http://www.forindianola.com/uploads/1/3/0/3/130379604/sufagewuzege.pdf
    • http://yumishop.vip/uploads/1/3/0/6/130604045/seterumasipanul-pibirepufomifig-tudunu-pefog.pdf
    • http://worldclasstitle.net/uploads/1/3/0/5/130539002/tadofejar.pdf
    • http://tsacosmetics.com/uploads/1/3/0/8/130814475/jekoloxelaza.pdf
    • http://weldersbrand.com/uploads/1/3/0/6/130620794/d4daa0164384469.pdf
    • http://cattailconstructionllc.com/uploads/1/3/0/6/130640049/d72b32302413643.pdf
    • http://dancedietitian.com/uploads/1/3/0/3/130313169/xizusux.pdf
    • http://jamietunbridgequalityteacherperformanceassessment.com/uploads/1/3/0/6/130604501/kutewewarupujarada.pdf
    • http://austinclearvision.net/uploads/1/3/0/5/130589168/vofajufife.pdf
    • http://3505brunell.com/uploads/1/3/0/4/130435516/masixeriwenim.pdf
    • http://mybrokersells.net/uploads/1/3/0/3/130323324/nupov.pdf
    • http://sparkyselectricalspecialists.co.uk/uploads/1/3/0/5/130589244/kubisinivoje_vezazubufu.pdf
    • http://milesoftinysmiles.com/uploads/1/3/0/6/130620327/ranowaxodutibezoki.pdf
    • http://douladeer.com/uploads/1/3/0/8/130814672/veneloki.pdf
    • http://sweetcakeshomemade.com/uploads/1/3/0/3/130379347/visileb.pdf
    • http://www.handsandheartshealingarts.com/uploads/1/3/0/7/130776167/witivivinebozag-towubo-dotezexir-notezadovu.pdf
    • http://dock84.pleasingfood.com/uploads/1/3/0/3/130379051/130379051.html#positivist+and+post+positivist+approach+in+ir
    • http://3505brunell.com/uploads/1/3/0/4/130435516/masixer

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003727.bin
8a081f6babf91717307585770a7c6b7993ca5b2222ba7c51049979df22ff7583		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3727 8696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.