Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca8bc7e8f891e646…

MALICIOUS

PDF

36.8 KB Authoring application: Mobipocket Creator
MD5: 3f72580adabecfa68def51d6df617c4c SHA-1: ab7576738b66491ca6d0de2286adad0cf0b8827c SHA-256: ca8bc7e8f891e64635becdf9af2ab48a5fe972e9728e3855e032b201f620b476
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious intent. The document body text, though truncated, mentions 'Typhoid vaccine for babies in india' which could be a lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://catv47.com/uploads/1/3/0/8/130814339/554504f02aa7e2.pdf
    • http://punkcentre.com/uploads/1/3/0/6/130620576/8245199.pdf
    • http://nerdvil.com/uploads/1/3/0/6/130639672/wowusewabe.pdf
    • http://movementandmeaning.com/uploads/1/3/0/7/130775252/lonusivavi.pdf
    • http://nextax.net/uploads/1/3/0/6/130639641/papubefo-gifedenipeb.pdf
    • http://kevinaverycomedy.com/uploads/1/3/0/5/130542909/4500179.pdf
    • http://offthepier.net/uploads/1/3/0/7/130739284/5249184.pdf
    • http://ntcigraffiti.com/uploads/1/3/0/3/130379162/1bfc26b504d5b88.pdf
    • http://www.akhaltekebreeders.com/uploads/1/3/0/9/130969750/pufekabitutuj_fekifutafi_noraf_juletogazo.pdf
    • http://bbq4hope.com/uploads/1/3/0/6/130639709/zazawakizevig-duwewujifuni-sofalesav-litemime.pdf
    • http://millerhahn-wedding.rominastiebenphotography.com/uploads/1/3/0/6/130621483/130621483.html#typhoid+vaccine+for+babies+in+india
    • http://www.akhaltekebreeders.com/uploads/1/3/0/9/130969750/pufekabitutuj_fekifuta

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002389.bin
0a97bde9752fdee1f3e7370c79030bd93fe90b264c0961419b1ed7afc578e67c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2389 16104 bytes
font_01_sfnt_off00003acd.bin
400bab57e8398d14dcf2d366638927fa19a0f3190b2012eab84e6fe3b32fe3d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3ACD 7404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.