Malicious PDF — malware analysis report

Static analysis result for SHA-256 deda122594d5b2b9…

MALICIOUS

PDF

42.2 KB Authoring application: pstoedit
MD5: 6f5ec6cf9782013ca7fd3e02d8c09acc SHA-1: bb345ecd5be4335cdf0f1807073f218404becf21 SHA-256: deda122594d5b2b9579a97044c0aab3f3f1d65c6c4968648008b25d2b645d3ad
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection indicates this is a known phishing or traffic-robot distribution technique. The embedded URLs are likely used to redirect users to malicious sites or to distribute further malware. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tenkiwi.com/uploads/1/3/0/6/130639027/mefeduwufu.pdf
    • http://782hustle.com/uploads/1/3/0/6/130603836/2769822.pdf
    • http://mmjplantation.org/uploads/1/3/0/8/130815093/fivofoxaxopan_zenojijowewegi.pdf
    • http://www.ecoteck-pilleovn.dk/uploads/1/3/0/7/130739060/raluzibuxubakuda.pdf
    • http://www.lewiskingstreeservice.com/uploads/1/3/0/6/130621444/848e365feaec.pdf
    • http://squeezeapparel.com/uploads/1/3/0/2/130289564/gebepitut-kamomepe-letivobejazi-rimexod.pdf
    • http://www.northernbaptisteducationsociety.com/uploads/1/3/0/6/130621606/kemulalupipusobapiso.pdf
    • http://genuinefenderparts.com/uploads/1/3/0/7/130739080/bc9f04bf1fab.pdf
    • http://brookhavenneighbor.com/uploads/1/3/0/5/130539768/lowilek-guzemizifid.pdf
    • http://millennialrealtysolutions.com/uploads/1/3/0/7/130738706/forogexenuj_vozofizadupo.pdf
    • http://thefamas.org/uploads/1/3/0/6/130604177/jaxexofo.pdf
    • http://gishack.com/uploads/1/3/0/2/130291531/fegarut.pdf
    • http://risearise.com/uploads/1/3/0/4/130435745/luzapa.pdf
    • http://www.bestbroadbandsupplier2019.co.uk/uploads/1/3/0/5/130546096/f563cc44d6f423.pdf
    • http://musclesandmimosas.us/uploads/1/3/0/5/130538945/8d094f4c0.pdf
    • http://vandenbossracing.com/uploads/1/3/0/6/130639664/rixafadumojinor_pugetivuxapip.pdf
    • http://pitparts.net/uploads/1/3/0/5/130590412/486fe41490537.pdf
    • http://path.wolc.com/uploads/1/3/0/4/130488750/doxawalotul_negid_vobilizezi_zosuxepemixi.pdf
    • http://74-123-72-143.mgwnet.com/uploads/1/3/0/2/130289651/130289651.html#indian+wedding+vegetarian+buffet+menu
    • http://www.lewiskingstreeservice.com/uploads/1/3/0/6/130621444

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047da.bin
93c27862d5cf7246b6578c9ef8e9da69669214b28c63bda61923af04172b947c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47DA 7884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.