Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2e01228d50fd4b2…

MALICIOUS

PDF

43.9 KB Authoring application: PDFBox
MD5: 5245915364af54c46ab2cf0fdc86429b SHA-1: 5d79bc23c12aa71ca18af2f7711066bc06f63e9c SHA-256: c2e01228d50fd4b2899a030e7eecc37252460eaba751e054220c5eb4f8dd4672
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains, indicating a link farm or redirection scheme. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic-driving intent. The embedded URLs are the primary indicators of this malicious activity.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://minmov.com/uploads/1/3/0/6/130605314/gelaxiwiwanitifegi.pdf
    • http://bellarosacr.com/uploads/1/3/0/5/130540559/kudunujenokotisero.pdf
    • http://vpstestsite.com/uploads/1/3/0/6/130639026/9d01879b5e5.pdf
    • http://mountaintimecolorado.com/uploads/1/3/0/7/130775527/vavotexirugav.pdf
    • http://midnightoilscompany.com/uploads/1/3/0/3/130313148/4296678.pdf
    • http://milanchurch.com/uploads/1/3/0/3/130313427/6f1e752fb94c6.pdf
    • http://phadeologist.com/uploads/1/3/0/5/130538840/4118845.pdf
    • http://www.swhalenart.com/uploads/1/3/0/3/130323488/b2f82b496f959.pdf
    • http://precisionskitune.com/uploads/1/3/0/2/130271187/deloxu-xulosinixik-zaxulixif-fejukaluzul.pdf
    • http://oregonnw.net/uploads/1/3/0/2/130272234/surovexikifurud-sezavewipaf-galifanosega-jisuxuwom.pdf
    • http://financial-plan.services/uploads/1/3/0/8/130874493/5487262.pdf
    • http://adrisbeautystudio.com/uploads/1/3/0/5/130550967/2e9591f4864f58.pdf
    • http://71-159-221-59.overtimefitness.com/uploads/1/3/0/7/130739387/130739387.html#11th+class+biology+book+download+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f90.bin
10fd41e484bbb68eafc02e469a868ed9edbcd2aef42380529a8bc1def562b8e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F90 12580 bytes
font_01_sfnt_off00005321.bin
45376d57f20cff929f44c9804c27066f1f9e6f54aae3a756ca00043f31091ec1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5321 8180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.