Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca7c1dcba380e3b4…

MALICIOUS

PDF

53.7 KB Authoring application: Solid Converter PDF
MD5: 7e04945ebd7813936971181eb3cd3f6f SHA-1: 4c90e737d437e50641149ca2cf548addb89a4746 SHA-256: ca7c1dcba380e3b4b473571de7796a5bc158eba879806f9330846522d63e7a29
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO poisoning attack. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing intent. The embedded URLs are likely part of this malicious infrastructure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://microbearding.com/uploads/1/3/0/5/130590613/kitebitatisapoj_baliv.pdf
    • https://jiwotapozaxira.weebly.com/uploads/1/3/0/3/130323106/2441855.pdf
    • http://mswoodman107.com/uploads/1/3/0/7/130740151/lavubaxe.pdf
    • http://christchurchportland.org/uploads/1/3/0/2/130271161/kolanufises.pdf
    • http://apexairsoftus.com/uploads/1/3/0/2/130287529/130287529.html#bogleheads+guide+to+three+fund

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001301.bin
7444e907d9b89ea808484e9cdf0f345066a2260477f77dda4a4ede9842317e40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1301 9308 bytes
font_01_sfnt_off0000980b.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x980B 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.