Malicious PDF — malware analysis report

Static analysis result for SHA-256 c97ce9d6c0b5b6bb…

MALICIOUS

PDF

32.6 KB Authoring application: PDF Studio
MD5: 87cc0f03619c389d1ab330d32a01b133 SHA-1: 61fa72cd353116d6ed5adaf843f0ad0ef3fad3a5 SHA-256: c97ce9d6c0b5b6bbfdbec4dbd2135fdc5dc105931d113718ec3ca85d0874b10d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious distribution intent. No scripts were extracted from this sample, and the document body contained mostly obfuscated or irrelevant text.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://musingsofageek.com/uploads/1/3/0/4/130483895/9460655.pdf
    • http://delarosacreations.net/uploads/1/3/0/7/130776516/2331798a3af.pdf
    • http://norbertfodor.com/uploads/1/3/0/5/130551166/332d04af13bbf53.pdf
    • http://royalematch.com/uploads/1/3/0/7/130739376/f42d99993.pdf
    • http://faw.comparatuapuesta.com/uploads/2020/01/28/wodifemi_kexozufe.pdf
    • http://9thwonderco.com/uploads/1/3/0/6/130604769/2332578.pdf
    • http://newstylemarket.com/uploads/1/3/0/7/130740000/130740000.html#ethylene+vinyl+acetate+copolymer+uses

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010e7.bin
8038f6c816b879920823550cbcb6ebab18cb309b2c432d427975730cecb49491		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E7 8312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.