Malicious PDF — malware analysis report

Static analysis result for SHA-256 c81b68679ccdf647…

MALICIOUS

PDF

40.3 KB Authoring application: Solid Converter PDF
MD5: 959c224fd88615ac35992f5d1c1c4fee SHA-1: 4989fe46eb533e422b740b74586f71e9cfe70f7a SHA-256: c81b68679ccdf6479dc3f9cab474187cb03774484af7fd26e7a70f894b39e89b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits a critical heuristic firing for a link farm, containing 31 external PDF links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further indicates a phishing or redirection intent. The embedded URLs are likely part of a campaign to lure users to malicious sites. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ateliernewstory.com/uploads/1/3/0/5/130551433/fuvoguxafelexe-ligepa.pdf
    • http://ashleighjane-adventure.net/uploads/1/3/0/5/130550949/5673586.pdf
    • http://unicornsontheloose.com/uploads/1/3/0/4/130435601/mibitetanon.pdf
    • http://texassupercool.com/uploads/1/3/0/8/130813030/tasaxawimazix-rivezepibag-rojogoxasipovor-zizumede.pdf
    • http://waterstonecafe.com/uploads/1/3/0/3/130379297/04bc11dbbe8e84.pdf
    • http://www.hamptonroadsauctions.com/uploads/1/3/0/5/130588700/57c39903834867c.pdf
    • http://cjmacdoug.com/uploads/1/3/0/3/130324164/dasaresuvidetapijibe.pdf
    • http://www.knottahaybarn.com/uploads/1/3/0/8/130873880/silufub_matipe.pdf
    • http://laurenobern.com/uploads/1/3/0/5/130539928/416723883a9adb.pdf
    • http://delorenzohaircare.com/uploads/1/3/0/3/130379625/rezebufod-gifetigate-satumunozaw-jerilubibider.pdf
    • http://mentalhealthhelpforyou.org/uploads/1/3/0/3/130379429/5877961.pdf
    • http://www.ceoyear.com/uploads/1/3/0/8/130874110/sefukowabuxinimuk.pdf
    • http://boyntonbeachrecovery.com/uploads/1/3/0/6/130639901/2127148.pdf
    • http://nextgenerationatl.org/uploads/1/3/0/6/130621100/wirapik-pujapujezoraduz.pdf
    • http://lilbitscloset.com/uploads/1/3/0/3/130379821/revovazimag.pdf
    • http://exploreeasttennessee.com/uploads/1/3/0/4/130489023/dfd1cb276f6.pdf
    • http://saltlakeletterpress.com/uploads/1/3/0/7/130739652/6325952.pdf
    • http://mta-sts.pamelapalmadesigns.com/uploads/1/3/0/4/130435839/130435839.html#o+que+%C3%A9+aerogenes
    • http://texassupercool.com/uploads/1/3/0/8/130813030/tas

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000322f.bin
6dc6e07f93ae70488a19e8a398a1c6cda2f5723fc3d3cbe180c5afbb10c3611e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x322F 2864 bytes
font_01_sfnt_off00003f27.bin
6450fee47598dcc08f2c9e66f7d43f4c744139cbaa6e724b0a50ad62cbee64a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3F27 9056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.