Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba7d8ffbc097f6ff…

MALICIOUS

PDF

37.4 KB Authoring application: Mobipocket Creator
MD5: 3ba5d0fb0bb4f86a5d4b20d25d738046 SHA-1: e7d26e90ad79136a96fb60db4891387682887e9c SHA-256: ba7d8ffbc097f6fffbb215117dc1716192c3f9e74b348b7a890b916470c63cc2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm designed to direct users to potentially malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection. The document body itself is heavily obfuscated and does not provide clear user-facing content, further supporting the interpretation that the primary function is to facilitate access to these external links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://user-centred.design/uploads/1/3/0/2/130292013/cb722c31e9.pdf
    • http://mortonslawoffice.com/uploads/1/3/0/7/130774972/877725.pdf
    • http://www.gametimeranch.com/uploads/1/3/0/5/130544318/53c342d2.pdf
    • http://devilsticks.store/uploads/1/3/0/2/130271073/10bedc.pdf
    • http://myrole.io/uploads/1/3/0/4/130435938/firifewukovetafil.pdf
    • http://www.hey-pretty.com/uploads/1/3/0/6/130604419/7e421e7fb.pdf
    • http://beyondsoftware.com/uploads/1/3/0/3/130379408/jibafufalikuvupaset.pdf
    • http://lancestralcafe.com/uploads/1/3/0/7/130775201/4863b42bac1270c.pdf
    • http://williamfelts.com/uploads/1/3/0/6/130639743/najuf.pdf
    • http://bodyshotboxing.com/uploads/1/3/0/8/130873802/7516871.pdf
    • http://dfpinvestments.com/uploads/1/3/0/7/130775055/laxisagirububaw.pdf
    • http://onlinelarry.net/uploads/1/3/0/7/130738732/nomijide-sinutonokiku-davezowuwule-towatu.pdf
    • http://childproofingcolorado.com/uploads/1/3/0/4/130476732/xizomepuzesoruw.pdf
    • http://cheaptokeeptreesandlandscapes.org/uploads/1/3/0/6/130604218/1021606.pdf
    • http://mrviolinsd.com/uploads/1/3/0/4/130488530/5312757.pdf
    • http://haiyi-hotels.devsite-1.com/uploads/1/3/0/3/130379638/e1d98942d4.pdf
    • http://hiltyhazzard.com/uploads/1/3/0/6/130621432/jefakijuduwomax.pdf
    • http://neuvenicephoto.com/uploads/1/3/0/7/130776325/3cc0d.pdf
    • http://downlinecheatsheet.com/uploads/1/3/0/2/130272859/4508727.pdf
    • http://elainesstudio.com/uploads/1/3/0/7/130738883/luguro.pdf
    • http://www.monastry.co.uk/uploads/1/3/0/9/130969045/pekojuxu.pdf
    • http://mirrorsireland.com/uploads/1/3/0/6/130603721/93e07ddc94ee37.pdf
    • http://mta-sts.mx.acousticfloydtribute.com/uploads/1/3/0/7/130740145/dorezetira.pdf
    • http://chopshopsaladshop.com/uploads/1/3/0/5/130588560/terex.pdf
    • http://concordat3.pleasingfood.com/uploads/1/3/0/6/130620453/130620453.html#liberalismo+economico+libro+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f2c.bin
e2c7004ce88fe37bad2fb7e9f186ad7c5c1e5c1fd378a57bc4d60a9a903234f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F2C 8316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.