Malicious PDF — malware analysis report

Static analysis result for SHA-256 e015d5db89b4df79…

MALICIOUS

PDF

66.7 KB Authoring application: Adobe PDF Library 9.0
MD5: 6abd3ade4e25dc8f9feb0f4d75bb9ed1 SHA-1: 21af24bf73d1e15b72ccebace7bef5f9fa265902 SHA-256: e015d5db89b4df793ed401cb8eef692e917fad6506cdc8783f70f9f9711f0c55
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. The embedded URLs likely lead to phishing sites or further malware downloads.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pmgfiletransfer.com/uploads/1/3/0/5/130589140/7439526.pdf
    • http://aqzsystems.net/uploads/1/3/0/6/130603959/sesopapileja.pdf
    • http://www.littleredrobinjewellery.co.uk/uploads/1/3/0/4/130484005/rususovedala-wokafoled.pdf
    • http://website.elkethoms.com/uploads/1/3/0/6/130621496/degakirumotumam_lijizuw.pdf
    • http://lifeisbeautifulphotographybybecky.com/uploads/1/3/0/4/130435909/2688827.pdf
    • http://ideascreativity.com/uploads/1/3/0/7/130739070/98de040.pdf
    • http://chicagobeachsoccerleague.com/uploads/1/3/0/4/130477234/7132624.pdf
    • http://jilliantomco.com/uploads/1/3/0/8/130814531/woxitazidotivoleda.pdf
    • http://questdjs.com/uploads/1/3/0/7/130775734/kopikil-lulonaji-mulewelez-lokefifezubom.pdf
    • http://belindabucknell.com.au/uploads/1/3/0/6/130640175/5603821.pdf
    • http://gncseattle.com/uploads/1/3/0/6/130639458/levevanaba_sevogujodo_guboge.pdf
    • http://beach-music.com/uploads/1/3/0/6/130620366/josotubazajenefinus.pdf
    • http://airbrushinggourds.com/uploads/1/3/0/5/130540507/0947fecfe6a6c47.pdf
    • http://barkleypet.com/uploads/1/3/0/3/130323268/zujaruxopifan.pdf
    • http://www.lgrimolfsonpe.com/uploads/1/3/0/5/130543979/numiralibexuwu_tejurijafiz.pdf
    • http://vegas-magic.com/uploads/1/3/0/6/130639026/fawudezo_kugabixev_rorozopiwovuj.pdf
    • http://agrimax-intl.com/uploads/1/3/0/7/130776790/saluverifiviti.pdf
    • http://moody.af/uploads/1/3/0/6/130605506/9013913.pdf
    • http://mandyfitzgerald.com/uploads/1/3/0/2/130274370/lizimonapufaf.pdf
    • http://myamigo.net/uploads/1/3/0/6/130605159/gogazafonofav-ximid.pdf
    • http://noblegoldens.com/uploads/1/3/0/6/130605440/dilix_mesupu.pdf
    • http://stellartrading.co/uploads/1/3/0/7/130739043/3fc7c867d.pdf
    • http://eco2magnesia.com/uploads/1/3/0/3/130323894/9873617.pdf
    • http://www.lunasattic.com/uploads/1/3/0/3/130312971/55091a510f.pdf
    • http://chichesterfootandankle.org/uploads/1/3/0/8/130814845/130814845.html#java+swing+gui+tutorial+netbeans

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001e66.bin
de3f8a7762c40f6859376bc52a6abb94f80c20c0c04b5fd06a891044f34edeb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E66 7664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.