Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7fe247e1abbaae9…

MALICIOUS

PDF

132.5 KB Authoring application: PDFBox
MD5: 533d0c199347c221f730ee549c57a816 SHA-1: ded10890a87cee769efe923c2d9b8f8951cca5bb SHA-256: b7fe247e1abbaae9cbe19d0d50076bf3647ec277e658617a4056a8eecd7d7e1c
168 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document employs an advance-fee scam lure, presenting a fake parcel delivery notification to entice users to click on numerous embedded links. The document contains a link farm, with the primary domain being 'miquelroig.com'. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious classification as a phishing document.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://miquelroig.com/uploads/1/3/0/4/130436007/zemibidirav.pdf
    • http://forestavenuemedical.com/uploads/1/3/0/7/130740538/wakuvofolakapubu.pdf
    • http://arty-lab.com/uploads/1/3/0/2/130271177/53d2a0c3867c.pdf
    • http://ravisatyakahn.com/uploads/1/3/0/6/130605420/7754186.pdf
    • http://mitchellwenkus.com/uploads/1/3/0/5/130538959/xirezamokemo.pdf
    • http://whiskeyvegan.com/uploads/1/3/0/7/130738719/zenekavil-boxixubikago.pdf
    • http://nounoula.com/uploads/1/3/0/7/130775363/9db63176514.pdf
    • http://arkiv.rokus.no/uploads/1/3/0/6/130620635/9432441.pdf
    • http://miv.mezoter.ru/uploads/2020/01/28/1804465.pdf
    • http://1169certified.info/uploads/1/3/0/2/130274371/613a6556d26523.pdf
    • http://fakubigo.xelamit.ru/uploads/2020/01/29/nomuwigidimugafad.pdf
    • https://renepemo.weebly.com/uploads/1/3/0/2/130289774/vusurefi.pdf
    • http://sauerlandhypotheek.nl/uploads/1/3/0/4/130475955/130475955.html#acc%2Faha+heart+failure+guidelines+2013+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012d8.bin
eff6bee0aa245838812126a656210669144a1f20b2bfc77f8326bdf8ba0527e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D8 8820 bytes
font_01_sfnt_off0000a7ba.bin
2959476c5f94eab6b6b2ffd9cf8eddac6ccb1c6c7aee9290b1d2b651b3211ebd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA7BA 16040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.