Malicious PDF — malware analysis report

Static analysis result for SHA-256 c223913c1b49357b…

MALICIOUS

PDF

35.0 KB Authoring application: Pdftk
MD5: 3da627a32158dea7a3590f754e7d69ad SHA-1: 9a292fedbe7a0bb9e289dce465ce6a5ce8d33383 SHA-256: c223913c1b49357be2e8eacbdb9b87c4429ff049a9d80ca1e115cde98f283695
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted from this sample, limiting the ability to determine specific execution chains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://houseofcreativedigital.com/uploads/1/3/0/3/130313422/xatudatijipek-fumezuja.pdf
    • http://drderickclinic.com/uploads/1/3/0/2/130274098/mubudebutasemi_mefexur_zojexu_xegaxazobe.pdf
    • http://aakyoga.com/uploads/1/3/0/7/130776394/kixozamugabowugo.pdf
    • http://www.hollywoodbeautythreading.net/uploads/1/3/0/6/130639462/vometarevosuwe_limide.pdf
    • http://ntkdomains.com/uploads/1/3/0/7/130775828/6358964.pdf
    • http://nwcg.yourgin.com/uploads/1/3/0/7/130739127/6229100.pdf
    • http://amazingamericanstv.com/uploads/1/3/0/6/130620956/9d0ab.pdf
    • http://mx.robertfountain3.com/uploads/1/3/0/8/130874567/barox.pdf
    • http://www.rkzgeneralcontractors.com/uploads/1/3/0/2/130291475/lidilebabujamava.pdf
    • http://moongy.org/uploads/1/3/0/4/130483953/rokoku.pdf
    • http://pathproduct.com/uploads/1/3/0/5/130551836/3247104.pdf
    • http://getneckhammock.net/uploads/1/3/0/4/130491699/napurir-bazep-kodoxel.pdf
    • http://depthstiny.com/uploads/1/3/0/3/130312916/gunomafegofogeva.pdf
    • http://sparkcatholics.com/uploads/1/3/0/6/130621412/4897359.pdf
    • http://miniturecowboysrus.com/uploads/1/3/0/2/130289460/4703229.pdf
    • http://reapvalue.net/uploads/1/3/0/7/130739505/d3a5f1493.pdf
    • http://jehrv.slpny.com/uploads/1/3/0/6/130604126/130604126.html#excel+apache+poi+java
    • http://depthstiny.c

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c76.bin
2155a1501a9a70de6f5bad073069e53769c083676b3b3f78f2302729e90d41c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C76 8180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.