Malicious PDF — malware analysis report

Static analysis result for SHA-256 deb75bbabce6d758…

MALICIOUS

PDF

50.0 KB Authoring application: pstoedit
MD5: cdcc61765aa04ced50230cb7c37e6314 SHA-1: 165652986ab054f6afd3bc8c969dc80af4c0bdf8 SHA-256: deb75bbabce6d758679edc2cf8b73c342284b3c1ad2cef290ff78dde87366407
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to PDF files on various domains, indicating a link farm for SEO or phishing purposes. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly suggests the document's content is designed to trick users into paying fees for a prize or parcel. ClamAV also identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded URLs are likely used to direct users to malicious content or further phishing pages.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://brainrinsing.com/uploads/1/3/0/6/130621024/resaris.pdf
    • http://autodiscover.paulsturfandtree.com/uploads/1/3/0/6/130604358/sajatapixipimovow.pdf
    • http://mta-sts.mx.crchog.org/uploads/1/3/0/5/130539249/wulug.pdf
    • http://communitycure.net/uploads/1/3/0/6/130639540/mijowowewir_bavifiw_vogurag.pdf
    • http://swankyfork.com/uploads/1/3/0/5/130539516/8114919.pdf
    • http://erinandevan.com/uploads/1/3/0/6/130621200/b0d0624e.pdf
    • http://guru-inside.com/uploads/1/3/0/4/130488228/gerejuputepetubafuz.pdf
    • http://kevindeuso.com/uploads/1/3/0/5/130546486/1335771.pdf
    • http://immigrantsday.org/uploads/1/3/0/8/130814020/349ab.pdf
    • http://dcbiggs.com/uploads/1/3/0/2/130271184/143ce836.pdf
    • http://www.chemicalbathsaltsonline.com/uploads/1/3/0/5/130541743/davosevufe.pdf
    • http://micheletroy.com/uploads/1/3/0/6/130603704/sararin.pdf
    • http://domesticsquirrel.com/uploads/1/3/0/7/130738623/putufu.pdf
    • http://benchmark-your-store.com/uploads/1/3/0/2/130289254/jowasagaketusam-wesibo.pdf
    • http://precisiondecorative.com/uploads/1/3/0/5/130588754/cc6243b.pdf
    • http://www.torsodecor.com/uploads/1/3/0/4/130488288/loxanifagaki.pdf
    • http://fightingthefight.org/uploads/1/3/0/7/130776110/8244a61e4e.pdf
    • http://kristenshirts.com/uploads/1/3/0/6/130639138/7edf89efa97be.pdf
    • http://yenisiyasetkulturu.com/uploads/1/3/0/2/130288402/a0ca0ea8bea.pdf
    • http://www.yaayaavintage.com/uploads/1/3/1/0/131070072/7308282.pdf
    • http://crystaldictionary.online/uploads/1/3/0/5/130589004/92047a56.pdf
    • http://ecopowerelectric.net/uploads/1/3/0/7/130740116/130740116.html#airtel+digital+tv+recharge+monthly+plans

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ae4.bin
32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56
pdf-font-stream PDF embedded font (sfnt) at offset 0x4AE4 16164 bytes
font_01_sfnt_off000062c3.bin
6cf8236914f0941e88b218207c3b7e85b0b144635fa96c6accfc1bb4d336d13e
pdf-font-stream PDF embedded font (sfnt) at offset 0x62C3 8248 bytes