Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce178ec90d3c2721…

MALICIOUS

PDF

37.1 KB Authoring application: pstoedit
MD5: 96214cdf5cffa6218aaef826217675cb SHA-1: 77aa976a539869bb42d9870d62928e3d35684c2c SHA-256: ce178ec90d3c2721140a321f3be118c58a86d7f3ea44f90fe0cd46765bf6f918
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://honeyee.us/uploads/1/3/0/5/130551585/xolit-zujalutare.pdf
    • http://elmiloveyou.com/uploads/1/3/0/5/130588389/vojujufinatum.pdf
    • http://ponyenzo.com/uploads/1/3/0/6/130620268/1656635.pdf
    • http://nevrapoint.com/uploads/1/3/0/3/130323216/lifolasaz-ravino-niwebimimak.pdf
    • http://mobilemassagenc.com/uploads/1/3/0/3/130379266/fupitu_zejisu_nexozo_difuj.pdf
    • http://cureand.com/uploads/1/3/0/7/130740186/1600653.pdf
    • http://www.morjanaspain.com/uploads/1/3/0/6/130604710/babojesi.pdf
    • http://liberationliving.com/uploads/1/3/0/2/130289577/donidujagadumupi.pdf
    • http://cocksplosion.com/uploads/1/3/0/5/130588307/6502484.pdf
    • http://thatsummer.org/uploads/1/3/0/4/130483875/visarasu.pdf
    • http://davidchia.com/uploads/1/3/0/3/130323767/tufasu.pdf
    • http://tntrenovations.net/uploads/1/3/0/5/130590241/9106406.pdf
    • http://8101obannon.com/uploads/1/3/0/3/130313149/83343.pdf
    • http://carolinaopticalbluffton.com/uploads/1/3/0/7/130739170/254eb818feaf.pdf
    • http://dobbsferryptsa.org/uploads/1/3/0/8/130874600/gibonafajunomepizu.pdf
    • http://ivflush.com/uploads/1/3/0/7/130739121/3dbbfcc336f1.pdf
    • http://23qg.com/uploads/1/3/0/5/130547846/08faf019.pdf
    • http://longislandshowroomdoors.com/uploads/1/3/0/3/130323656/546173.pdf
    • http://thevapelounge.co.nz/uploads/1/3/0/7/130776667/8ae6a52f1.pdf
    • http://nycpublishingco.com/uploads/1/3/0/6/130620520/sivojapimaf.pdf
    • http://jingleexpert.com/uploads/1/3/0/8/130874219/pikazarajopu.pdf
    • http://suo4pa8xo1w.butterfly520.com/uploads/1/3/0/7/130776338/jinawozoloda.pdf
    • http://adsl-63-204-18-26.benefitplans.org/uploads/1/3/0/7/130775904/130775904.html#eustachian+tube+and+ringing+in+ears

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003337.bin
c3a29a9261fde751b0bd2e379c912d361984839c1c18b9f855513ea21767332c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3337 6720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.