Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8a3cd88326aad98…

MALICIOUS

PDF

41.9 KB Authoring application: PDFedit
MD5: 42200fd3fb2e22c8a5501586b31446b7 SHA-1: a1590a20e8d396619bae77a3fff32ef13f370391 SHA-256: c8a3cd88326aad9825d71835a8ca6d240713327577161c3940db0bbc05136da2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to malicious content. The ClamAV detection further supports the malicious nature of the file.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.everetteenterprisesinc.com/uploads/1/3/0/4/130488123/2209959bb9407.pdf
    • http://joshandaprilbrand.com/uploads/1/3/0/6/130621516/puwafu-jejafufonexo-jasumukawisol-gukefor.pdf
    • http://urdentistpvr.com/uploads/1/3/0/4/130436028/7889161.pdf
    • http://mx.olol-church.com/uploads/1/3/0/6/130604666/127330.pdf
    • http://mooderopah.co.uk/uploads/1/3/0/6/130620859/343aeeec2b.pdf
    • http://meugrupovip.com/uploads/1/3/0/8/130814411/8475105.pdf
    • http://honorabull.com/uploads/1/3/0/8/130873915/5852536.pdf
    • http://newworldcreator.com/uploads/1/3/0/7/130740124/bofetegofuj.pdf
    • http://www.whatyourbabyneeds.com/uploads/1/3/0/3/130313081/e521e702c.pdf
    • http://opentimeline.com/uploads/1/3/0/2/130289695/nukadaw.pdf
    • http://hollandbuilt.com/uploads/1/3/0/8/130873976/6980329.pdf
    • http://mrfriedliclass.com/uploads/1/3/0/4/130483866/mukibanofa_pajewenujuka_safupefomofigev_loxaxur.pdf
    • http://starzbetterworld.com/uploads/1/3/0/6/130621732/tejig.pdf
    • http://nakedpavementbooks.com/uploads/1/3/0/4/130435881/gigozugapedamalur.pdf
    • http://www.holcombhaus.com/uploads/1/3/0/3/130323335/41735a24e4e35.pdf
    • http://www.igtbookkeeping.com/uploads/1/3/0/4/130477979/ranozeramijo.pdf
    • http://www.botanicalboutique.us/uploads/1/3/0/5/130589114/mezopotagopag.pdf
    • http://mail.craigreynoldsstudio.com/uploads/1/3/0/7/130775634/kexifavinusuworesuba.pdf
    • http://dcepool.net/uploads/1/3/0/6/130603983/b4f1d153b.pdf
    • http://lillianjue.net/uploads/1/3/0/3/130379841/wuxuzetodob.pdf
    • http://brokeitguy.com/uploads/1/3/0/7/130776483/niganusawoxojusemepe.pdf
    • http://churchofchrist-wellston.com/uploads/1/3/0/5/130588443/falupafijidoju.pdf
    • http://therealstage.com/uploads/1/3/0/4/130483400/wisipegivof_napadejikububi_sepelo.pdf
    • http://deltalandandhome.com/uploads/1/3/0/2/130274151/6779269.pdf
    • http://www.dailyherbs.eu/uploads/1/3/0/4/130483271/130483271.html#easy+crochet+scarf+super+bulky+yarn

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004039.bin
6d957c64ad971f314fd8d27fbc11ccd2b8fc2d126c09bce49374b3b608cd8ba7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4039 8028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.