Malicious PDF — malware analysis report

Static analysis result for SHA-256 e30b05cc0b220275…

MALICIOUS

PDF

62.6 KB Authoring application: QPDF
MD5: 79a439753a5edc63d34ce1d32228c67c SHA-1: bc7fb8b49297aa4a7f644d663992d5684e671dd2 SHA-256: e30b05cc0b2202752247a8d8b8d12bfe8fa1e734411764e67ac4173ecd238892
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or redirection scheme, commonly used in phishing or malware distribution campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-robotting intent. No scripts were extracted from this sample, and the document body content is largely obfuscated and irrelevant.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://whyusehghgel.com/uploads/1/3/0/2/130287735/zoxivog-surajosepumer-punubezonulo.pdf
    • http://www.pubbliland.org/uploads/1/3/0/2/130289239/1473f036c17f.pdf
    • http://www.aalklatreklubb.com/uploads/1/3/0/5/130542728/8410355cf.pdf
    • http://nycgymnasticsmovement.org/uploads/1/3/0/5/130588763/tovos.pdf
    • http://reteish.com/uploads/1/3/0/6/130605254/9b2c7.pdf
    • http://theconnectionsacademy.net/uploads/1/3/0/7/130739087/biwijolokakevo-mezigowoz-bapajovogevag-takot.pdf
    • http://renfrowparrishhvac.com/uploads/1/3/0/6/130639889/bibawa.pdf
    • http://drbrentschillinger.com/uploads/1/3/0/7/130774966/peziledofa.pdf
    • http://lonepress.net/uploads/1/3/0/5/130588388/a637f7d7a4021f.pdf
    • http://www.ekomotif.com/uploads/1/3/0/6/130620971/71fbd9b.pdf
    • http://featherfallsmobileestates.com/uploads/1/3/0/7/130740015/3635202.pdf
    • http://www.cfdmcentralcalifornia.org/uploads/1/3/0/6/130621194/selufedidovorux.pdf
    • http://onecityhistoricalfoundation.com/uploads/1/3/0/6/130605228/poxokiwidazelu.pdf
    • http://kelly-peyton.com/uploads/1/3/0/4/130483492/4b57a.pdf
    • http://culturacura.org/uploads/1/3/0/8/130813403/mefirojeripimi-gaxobivafo-fozuwoviga-vopojifirebide.pdf
    • http://casahabana56.com/uploads/1/3/0/7/130740571/4218419.pdf
    • http://www.rhsdb.com/uploads/1/3/0/8/130873971/7813627.pdf
    • http://saddlemachine.com/uploads/1/3/0/5/130588501/8228123.pdf
    • http://vacavilleselfstorage.org/uploads/1/3/0/4/130476760/vasetekol.pdf
    • http://napervillecarpetclean.com/uploads/1/3/0/5/130538841/bf9de5849.pdf
    • http://candacegraham.com/uploads/1/3/0/5/130551418/a6e38b3190f87.pdf
    • http://neuropathydoctors.net/uploads/1/3/0/6/130604801/5286196.pdf
    • http://perillianconsulting.com/uploads/1/3/0/9/130969834/130969834.html#russia+world+cup+2018+team+points

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016ed.bin
beae953b3df30f00bcc8a7a38cc6d7e9d77e86bb61510d41d18bbd1a137abeef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16ED 8548 bytes
font_01_sfnt_off0000ba83.bin
7863b829de04ea8b7f5be4d5dae43fa62182e7611f0c3a300d10b316d27db496		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBA83 2732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.