Malicious PDF — malware analysis report

Static analysis result for SHA-256 eae427745de38733…

MALICIOUS

PDF

39.4 KB Authoring application: QPDF
MD5: 41fe8e0256f0efa82a511e96ad7c0743 SHA-1: 21deca3010c7f9e1d2e7092f75fae554a0c92f2b SHA-256: eae427745de38733428302e319547fcf53dedd1908584293c446a399e61fb230
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF files, a technique commonly used for SEO spam or to redirect users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving intent. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://girlfriendsfitnessparsons.com/uploads/1/3/0/7/130739396/f9f039c7f294d.pdf
    • http://iothinqs.com/uploads/1/3/0/5/130589423/ruruxes.pdf
    • http://itldo.net/uploads/1/3/0/2/130289523/da5b59bc41a43.pdf
    • http://nilakim.com/uploads/1/3/0/7/130775219/vazitazev.pdf
    • http://northstarbees.com/uploads/1/3/0/4/130483397/xipumasabatuz.pdf
    • http://sex888.site/uploads/1/3/0/4/130478433/bataxotuvusovirati.pdf
    • http://mta-sts.mail.livestyliv.com/uploads/1/3/0/7/130739763/fedofu.pdf
    • http://hostmaster.vonalten.com/uploads/1/3/0/2/130272319/xadekikobova_gegupal_nifiguxekujame.pdf
    • http://mkh-mfg.com/uploads/1/3/0/5/130550871/6ad1221203c9d6.pdf
    • http://bsstudio.virtus.hu/uploads/1/3/0/7/130740349/7666282.pdf
    • http://printeneur.com/uploads/1/3/0/6/130603834/9201d4.pdf
    • http://abimanyuvillasbali.com/uploads/1/3/0/8/130814851/63faaaf.pdf
    • http://blackbeardmarketing.com/uploads/1/3/0/7/130740551/gakiv.pdf
    • http://electdavidharris.com/uploads/1/3/0/5/130550742/tirodamuxinij.pdf
    • http://jodigardnermakeup.com/uploads/1/3/0/7/130776886/geworebotizugipaki.pdf
    • http://townofclermont.com/uploads/1/3/0/7/130776102/bonoporapujit-rejama.pdf
    • http://www.kontentsu.co/uploads/1/3/0/7/130775478/e21379747c3ad9d.pdf
    • http://jamesleachfineart.com/uploads/1/3/0/5/130550848/42e2e975cb.pdf
    • http://onlygodcanjudgeus.com/uploads/1/3/0/5/130539370/balutag-pujotevol-xidugu.pdf
    • http://backroadsbestclub.store/uploads/1/3/0/6/130604918/lepirejewex.pdf
    • http://electxt.com/uploads/1/3/0/2/130289493/vosajebasobuf-vajilo.pdf
    • http://bshppopup.com/uploads/1/3/0/2/130291646/130291646.html#dupilumab+fda+approval+age
    • http://mta-sts.mail.livestyliv.com/uploads/1/3/0/7/130739

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d96.bin
6f8a11d1ccf7eba94b25f6f7db5f968d10182086c6a129b27029ae30668dc5cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D96 2724 bytes
font_01_sfnt_off00003998.bin
0df738655e69ca6b450c9e2139eb415adfdb029db88ed429efe4f5be48b0611b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3998 7832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.