Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf5c73bf8bf2368c…

MALICIOUS

PDF

35.1 KB Authoring application: PDFedit
MD5: 7f2aba0603631c22ff5dd2098ad6fa9b SHA-1: 9b69d98332c437e2cb78232c44370fc79538f108 SHA-256: bf5c73bf8bf2368ca60bb07e1ad3fbd387cf6b1be874c1197c09363d50ef31da
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body mentions 'Diablo 2 no cd' and links to Blizzard, suggesting a lure related to gaming or software piracy.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rachnayoga.com/uploads/1/3/0/6/130621772/piravivubuxezapezox.pdf
    • http://cccvancouver.com/uploads/1/3/0/4/130483745/7428756.pdf
    • http://nickmosca.com/uploads/1/3/0/6/130620839/dejutataxi.pdf
    • http://migutakoju.prorealgame.ru/uploads/2020/01/28/ab5ea7565.pdf
    • http://butosaroko.fxtradeltd.info/uploads/2020/01/28/f3b09d.pdf
    • http://fintoro.com/uploads/1/3/0/2/130274282/mofumigusenibab.pdf
    • http://meshayla.com/uploads/1/3/0/3/130323516/130323516.html#diablo+2+no+cd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010c8.bin
991e2a00fcf66ff182b751e7c2b027a29d2e0c11ccba80407368e5cd72be2c3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C8 8380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.