Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2bf6057b117a889…

MALICIOUS

PDF

62.5 KB Authoring application: GIMP
MD5: 78e888da1dfb8193bae5fc44fb2470b1 SHA-1: fb2a7a5a2ed2f1234ac5ce48760271e3bf1e7389 SHA-256: e2bf6057b117a88923930905ad07470f2b3fbe27d938f1216d3d70e35b00f5bb
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the 'PDF_SEO_LINK_FARM' heuristic strongly suggest this document is part of a phishing or SEO manipulation scheme. The document body contains text related to 'Legend of Zelda Ocarina of Time 3ds rom free download', which appears to be a lure to disguise the malicious intent of linking to numerous external sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://carpetcleaningservicesla.com/uploads/1/3/0/4/130483540/valizoda_niduro_larugavase_midepujalowimil.pdf
    • http://prabhbroker.com/uploads/1/3/0/6/130620897/dd28b2c5d.pdf
    • http://branfordartcenterct.com/uploads/1/3/0/2/130270859/6ac1a478c9.pdf
    • http://burnellinfinitymath.com/uploads/1/3/0/5/130590511/bamolijiw-zotorejaxufibib-wokigikone-tunixib.pdf
    • http://obtainablewellness.com/uploads/1/3/0/4/130477126/8402888.pdf
    • https://zivazajulin.weebly.com/uploads/1/3/0/2/130272336/jadijobub.pdf
    • http://vintagefairedecor.com/uploads/1/3/0/6/130605353/23b390f3.pdf
    • http://mpcaa.net/uploads/1/3/0/7/130775978/jadifomewase_resejefofope_gedekeper.pdf
    • http://mrmacbiblebook2.com/uploads/1/3/0/3/130323291/130323291.html#legend+of+zelda+ocarina+of+time+3ds+rom+free+download

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000115c.bin
eaf92726e3d0121188c648f47f01bce4fcb0108af362212d46eb7f26db3f9587		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115C 8084 bytes
font_01_sfnt_off0000a4ea.bin
e62e49bd4c246f429594ecff0ecb09406291cc038972b0159564b574e72e9093		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4EA 1740 bytes
font_02_sfnt_off0000ad3e.bin
271624e1e3bef053f22f9ebb112b3e80f6dec1f0833c5851743416bbb41adc5a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAD3E 7048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.