PDF malware analysis — malicious · b5396e7cd43304e2

MALICIOUS

PDF

66.5 KB Authoring application: PDFedit

MD5: 2800f650ab5384e1d0960926e905eb13 SHA-1: a07328be44a76a068d7f2c6f07eab52ffe4808b9 SHA-256: b5396e7cd43304e20a72536d664a116c83e97017b774353cdb0bc980d6aff4bc

170 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm designed to redirect users to malicious sites. The SE_ADVANCE_FEE_SCAM_LURE heuristic indicates the document's content is likely a deceptive lure for scams. The CLAMAV_DETECTION heuristic confirms its classification as phishing malware. The embedded URLs are likely the primary mechanism for delivering the malicious payload or directing users to phishing sites.

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE

Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://tappycard.io/uploads/1/3/0/6/130605492/bamabejel.pdf
- http://nessasgoodiesshop.com/uploads/1/3/0/4/130488732/parusazis.pdf
- http://wildernesscreativeco.com/uploads/1/3/0/7/130740622/2597555.pdf
- http://storyspinner.net/uploads/1/3/0/3/130323291/9857669.pdf
- http://enads.org/uploads/1/3/0/4/130483748/zenitekig.pdf
- http://latriboo.com/uploads/1/3/0/6/130620341/moziwi.pdf
- http://harbrimedia.com/uploads/1/3/0/5/130589099/volimaduxewesumoweda.pdf
- http://casarefugiopa.org/uploads/1/3/0/6/130639177/6840123b0.pdf
- http://civlirightsreenactor.com/uploads/1/3/0/6/130604935/vejodumiboxoni.pdf
- http://boyde-studios.com/uploads/1/3/0/7/130738578/7245898.pdf
- http://justincollard.bio/uploads/1/3/0/5/130550755/bomowalok.pdf
- http://sullivanwoodart.com/uploads/1/3/0/2/130272440/fisirusarelopeni.pdf
- http://haroldhopkinson.com/uploads/1/3/0/7/130739713/876b2e2.pdf
- http://homesteadunitedfc.org/uploads/1/3/0/6/130639183/9930692.pdf
- http://smoothjazzisrael.com/uploads/1/3/0/3/130379226/cb0353c8b.pdf
- http://connectedsystems.io/uploads/1/3/0/6/130604150/8257772.pdf
- http://www.cherrypicked.ca/uploads/1/3/0/6/130640162/1202314.pdf
- http://www.eightytwentysalestraining.com/uploads/1/3/0/6/130605118/8323635.pdf
- http://nyicnamatrimonial.com/uploads/1/3/0/2/130289352/7344220.pdf
- http://guemeschannelembroidery.com/uploads/1/3/0/6/130621964/matipodulazawun.pdf
- http://www.massaworkswoodart.com/uploads/1/3/0/5/130588813/ba00d9aff0.pdf
- http://raunig-family.rominastiebenphotography.com/uploads/1/3/0/4/130435941/130435941.html#december+1+current+affairs+affairscloud

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000015f7.bin` `7bee98f8e0c6bff11c16d569cd381a97f8f43a4d2738568c010e95feb30465e3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15F7	8812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.