Malicious PDF — malware analysis report

Static analysis result for SHA-256 e96e3b90d9483a2e…

MALICIOUS

PDF

32.2 KB Authoring application: PDF Studio
MD5: 3cd9a967b67fe69351e390195ca7a430 SHA-1: 4e7f309d283182d76377ad02616a6a5933cac649 SHA-256: e96e3b90d9483a2e463fdda0edf27310ed10fbdb8a8b920c6480ca93bb2e1077
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was detected as a dropper by ClamAV. Static analysis revealed a large number of embedded external links, many pointing to PDF files on various domains. This suggests a link farm or a distribution mechanism for further malicious content. The document body itself contains garbled text and the URLs, indicating it is not intended for legitimate user consumption.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7820095-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7820095-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mingateachers.com/uploads/1/3/0/6/130620948/3396168.pdf
    • http://nrttourscentre.com/uploads/1/3/0/7/130776684/3637788.pdf
    • http://nkaskephotography.com/uploads/1/3/0/3/130323319/941a1631a4c.pdf
    • http://soulsinfriendship.org/uploads/1/3/0/6/130621483/pebuliduv.pdf
    • http://amcarizona.com/uploads/1/3/0/4/130478709/d508b2931dd488.pdf
    • http://fountainalleybodycare.com/uploads/1/3/0/2/130270832/kexerewel.pdf
    • https://jofavape.weebly.com/uploads/1/3/0/4/130476440/xafoniwokivezezo.pdf
    • http://capscoating.com/uploads/1/3/0/5/130540699/waxasavapiz_tibuxe.pdf
    • http://pitchtreemetalworks.com/uploads/1/3/0/6/130620946/witenexupamafofakis.pdf
    • http://mwilkinson91.com/uploads/1/3/0/5/130550994/d4e8bf21c6b2322.pdf
    • http://aufgutdeutsch.net/uploads/1/3/0/2/130291646/zefawove_dojavakumavuv_fesadetekud_pixopibetegoso.pdf
    • http://formormedia.com/uploads/1/3/0/2/130289443/130289443.html#auma+electric+actuator+catalogue

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001438.bin
f00683f0cb82f0ddf9421b35151e5f7bc67ec72b095f8a67e5fb2bfa405295e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1438 7820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.