Malicious PDF — malware analysis report

Static analysis result for SHA-256 b74397b68eba326b…

MALICIOUS

PDF

49.9 KB Authoring application: Smallpdf Desktop
MD5: 4421ecc62a3a1d8fca51ef769114f908 SHA-1: 4abd8296f668cb7712106f1ab6da39ee5a071ccc SHA-256: b74397b68eba326b7539cb96085d33dd470c4c7c33488c2eeedb16df0cae83ea
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, many of which are hosted on disposable domains, indicating a link farm designed to host phishing content. The heuristic 'SE_PAYMENT_REDIRECT_LURE' strongly suggests the document's content is a lure related to financial transactions, likely a phishing attempt. The ClamAV detection further confirms its malicious nature as a phishing PDF. The embedded links are the primary IOCs, pointing to potential phishing sites.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jibakuzudulevu.weebly.com/uploads/1/3/0/6/130604078/runidetularuzaf_kikuvibi.pdf
    • http://reimaginingwellness.com/uploads/1/3/0/4/130476491/985015.pdf
    • http://samodifolu.tral62.ru/uploads/2020/01/28/9369437.pdf
    • http://nazcamp.org/uploads/1/3/0/6/130621741/301545.pdf
    • http://mytmch.com/uploads/1/3/0/6/130639710/9275609.pdf
    • http://oaklandempowermentscholarshipprogram.com/uploads/1/3/0/3/130323401/8d7ebb2c45baf8e.pdf
    • http://carsforfood.com/uploads/1/3/0/6/130640029/256ebb0.pdf
    • http://creartivemedia.com/uploads/1/3/0/5/130540097/fizazi_pazotuted.pdf
    • http://661junkhauling.com/uploads/1/3/0/5/130589186/majososunapev.pdf
    • http://12stonesmoldcleaning.com/uploads/1/3/0/5/130588982/rabifizow.pdf
    • http://nethanelhunting.co.za/uploads/1/3/0/6/130639278/sagireda_lubedumimedam_savuxazon_rudilotejox.pdf
    • https://biwogese.weebly.com/uploads/1/3/0/3/130323091/tizuwati_zawamone.pdf
    • http://mohairregrowthsystem.com/uploads/1/3/0/5/130542875/34c2a3218d786c8.pdf
    • http://mhsdoernbecher.com/uploads/1/3/0/6/130622058/b0725036f.pdf
    • http://alaalohagirlsstate.org/uploads/1/3/0/6/130620910/vilapawimuvusumowas.pdf
    • http://lopolis.net/uploads/1/3/0/5/130590656/5791427.pdf
    • http://scimedart.com/uploads/1/3/0/6/130621488/vusiwatex.pdf
    • http://midtownatlantachiropractor.net/uploads/1/3/0/5/130590435/224425.pdf
    • http://chanabarriger.com/uploads/1/3/0/5/130547142/130547142.html#elixir+of+eros+pdf+free+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001807.bin
90d55045dae0e28c60e5896fb0e1e8fe907e6a35b2b4cf3c1cb5f2bbad7361f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1807 8840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.