Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1dd48d15a687771…

MALICIOUS

PDF

34.1 KB Authoring application: Poppler-utils
MD5: 3fbdb2e7ffe01f47a4c12cfaea646530 SHA-1: b2ecd3b5cdab323d98073714b5c91d5a88a58156 SHA-256: e1dd48d15a687771fba5f788fdd753d8cf5160b9c132631ecd90260b982ade6c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to redirect users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body contains garbled text and references to 'Types of forces worksheet grade 3', which appears to be a lure to disguise the malicious links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://southeastjet.com/uploads/1/3/0/4/130483338/eb7473ff8.pdf
    • http://oasismassagemckinney.com/uploads/1/3/0/5/130589384/dubufeguxipexis.pdf
    • http://ceecentre.com/uploads/1/3/0/5/130546457/tivumosu.pdf
    • http://mightyjunior.com/uploads/1/3/0/2/130287314/7219729.pdf
    • http://graceandflora.com/uploads/1/3/0/5/130539416/wefodabozakopep.pdf
    • http://meredithbirrell.com/uploads/1/3/0/5/130545666/130545666.html#types+of+forces+worksheet+grade+3

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001065.bin
45857ebfa82b87650fd7ef2f2f91cee81ad3fd8b4b3efc92a70ef80291c509d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1065 8276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.