Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc4f2e82b140a7ca…

MALICIOUS

PDF

45.4 KB Authoring application: ImageMagick
MD5: 8e064a3c8f70752b1848dc44ef0d80ad SHA-1: ff95e846288406198caf96bff205690c9270a051 SHA-256: dc4f2e82b140a7cae979a72ea081abe96d2f39040eabd68dc3781c6806b4181c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection. The document body itself contains irrelevant text mixed with these URLs, further supporting a deceptive purpose.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://avalanchebruidsboeketten.nl/uploads/1/3/0/6/130604498/nadikilitafuvajomu.pdf
    • http://thirdstate.org/uploads/1/3/0/2/130274256/fopuxalejifek.pdf
    • http://mobe-eze.com/uploads/1/3/0/6/130639567/gerejaga.pdf
    • http://scattered-leaves.com/uploads/1/3/0/5/130588494/rodokimipes.pdf
    • http://redskinscheerleaderalumni.com/uploads/1/3/0/6/130620778/4151979.pdf
    • http://cuffedbyjewels.com/uploads/1/3/0/3/130379272/4704418.pdf
    • http://bartbenson.com/uploads/1/3/0/6/130639100/mubokitubosezi.pdf
    • http://drtheresadobson.com/uploads/1/3/0/4/130435722/lizigawuxuzeded-dimunudugaviv.pdf
    • http://dromedariosmagicos.com/uploads/1/3/0/6/130604858/92e97d.pdf
    • https://sasitukifuwud.weebly.com/uploads/1/3/0/4/130483236/zibesozemi_kivigeluvinur_fijopavadon.pdf
    • http://kijofuviv.paypal-myaccount.net/uploads/2020/01/27/6263542.pdf
    • http://my-genuine-life.com/uploads/1/3/0/6/130639653/kevomusarotosa_wijirofinigire.pdf
    • http://endoflifedoula.co/uploads/1/3/0/5/130540159/5e0cbbb.pdf
    • http://wizidip.lux-scent.ru/uploads/2020/01/28/zapimetamu.pdf
    • http://miamicustomtours.com/uploads/1/3/0/6/130621046/wawonamapital_xerirebe_tewutawo_merade.pdf
    • http://kithara.org.au/uploads/1/3/0/6/130639344/3794959.pdf
    • http://2016found.com/uploads/1/3/0/6/130604541/rudenowasa-miduxikaberav-titavel.pdf
    • http://teseven.weebly.com/uploads/1/3/0/6/130621840/ed03b18bf9e.pdf
    • http://yorktownplumbing.com/uploads/1/3/0/5/130545627/130545627.html#ludwig+van+beethoven+moonlight+sonata+sheet+music

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001630.bin
6472557c7ba5ad8b6f33f2fe8b04cf4e953b88ce704d03d6c5fc48e33016291a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1630 9368 bytes
font_01_sfnt_off00006a7d.bin
0d5d1431431a9f8dc10f3748659f3927b3f3a14b81a73ef3b8e9723c206f5964		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A7D 16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.