Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3cee744f979c258…

MALICIOUS

PDF

52.6 KB Authoring application: QPDF
MD5: 7919f6ff3fd41a51e30621b9cc96e7d3 SHA-1: 52c4cc5c973be609add0938cd5b07d61bd2bd4aa SHA-256: e3cee744f979c2583817a11020df7d324ab5e865849966121130b26f7ffdfcb1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a technique commonly used for phishing or distributing further malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports this assessment. The document body contains text that appears to be a lure, directing users to click on links, one of which is http://stopclassroombias.com/uploads/1/3/0/4/130476778/2512743.pdf.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stopclassroombias.com/uploads/1/3/0/4/130476778/2512743.pdf
    • http://nailvenue.com/uploads/1/3/0/5/130588865/lukafekog.pdf
    • http://cranemoon.com/uploads/1/3/0/6/130604654/tuzumosegovir.pdf
    • http://nvui.org/uploads/1/3/0/6/130605175/343323dfe7d2.pdf
    • http://seedovation.org/uploads/1/3/0/6/130621496/c1f467137f7e.pdf
    • http://bakersacresfarm.com/uploads/1/3/0/3/130313641/nesofuxifezibi.pdf
    • http://ntagent.com/uploads/1/3/0/3/130324137/wawegatexobiwagus.pdf
    • http://myentouragemusic.com/uploads/1/3/0/6/130620429/130620429.html#chaahat+ki+khushboo+hd+video

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011ce.bin
9c7ae8a9d674dc1ad0e7323de0b6f13ad6fca141c4291ed543e4d97dde00d51f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CE 10016 bytes
font_01_sfnt_off00007d26.bin
378288d3133907284a1dd708aec606fa45674349f7e67e9eaedc79a8f6af9139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D26 16228 bytes
font_02_sfnt_off0000921d.bin
26ab20938e5f9d24d9660dff2b40c1a569a94a6d37d1303a4d400d51776d7a7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x921D 2316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.