Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea99e8bd88b118bd…

MALICIOUS

PDF

47.9 KB Authoring application: GIMP
MD5: 40d91a39589a65838bc1a3e86426966e SHA-1: e4b1a6432701370989a5011be02543786fea905d SHA-256: ea99e8bd88b118bdb54d8d3fee96e17d246afcc37b1a88644e200731d6464130
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a malicious intent to manipulate search engine results or redirect users to phishing sites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. While the document body mentions a 'Nest thermostat e installation guide uk', this appears to be a lure to disguise the malicious link farm.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bilufaresu.masternode-sc.com/uploads/2020/01/28/43c6f8.pdf
    • http://faguzu.blamecharlie.com/uploads/2020/01/29/db497e68845.pdf
    • http://mydarksites.com/uploads/1/3/0/2/130287915/kisadejegafumawu.pdf
    • http://yogaschoolkit.com/uploads/1/3/0/6/130604529/9049190.pdf
    • http://nounoucergy95.com/uploads/1/3/0/5/130551618/xidabujig.pdf
    • http://cruxportal.com/uploads/1/3/0/5/130542977/657584.pdf
    • http://tonces.net/uploads/1/3/0/2/130287965/bexenepulotunip_lefejezaloz_lonov_pepaxepelezur.pdf
    • http://0pi.online/uploads/2020/01/28/9677784.pdf
    • http://randrcantina.com/uploads/1/3/0/2/130289749/revagajebas.pdf
    • http://nationalriskmanagementgroup.com/uploads/1/3/0/5/130539267/130539267.html#nest+thermostat+e+installation+guide+uk

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001210.bin
7b7c2f7473f26b98868585abb39211eb30d9e9606647fd5f1dfb9dbf2ae148b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1210 8748 bytes
font_01_sfnt_off00007440.bin
3912474571564f9815d3d81727d0a166f4af2dbabd616628aeefdca604725dee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7440 16400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.