Malicious PDF — malware analysis report

Static analysis result for SHA-256 f07547c95d87ea6b…

MALICIOUS

PDF

45.9 KB Authoring application: pstoedit
MD5: 8a0e3e8083baae344feda869c2b69000 SHA-1: bc0b8ee265867081281355f1205261b08199dba7 SHA-256: f07547c95d87ea6bc795120d764f4d0efd2d861ce8674766f97f4652570d910d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. A critical heuristic firing indicated a 'PDF_SEO_LINK_FARM' with 23 external PDF links, the first of which is http://myoregonterritory.net/uploads/1/3/0/6/130621628/xovepupiko.pdf. This suggests the document's primary purpose is to host a large number of links, likely to redirect users to phishing or malware distribution sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myoregonterritory.net/uploads/1/3/0/6/130621628/xovepupiko.pdf
    • https://tukofozi.weebly.com/uploads/1/3/0/5/130588473/4885159.pdf
    • http://modelsenden.com/uploads/1/3/0/2/130273907/6108048.pdf
    • http://dianehulsejewelry.com/uploads/1/3/0/5/130589061/7783033.pdf
    • http://nathallybastos.com/uploads/1/3/0/5/130588231/gabezenevugekogaguso.pdf
    • http://ulito4ki.ru/uploads/2020/01/27/rujerewejotonebi.pdf
    • http://pasagoduv.dataerudite.com/uploads/2020/01/29/8822847.pdf
    • http://beatinghearthealth.com/uploads/1/3/0/6/130605307/0932cb82f276.pdf
    • http://faje.evaluados21.com/uploads/2020/01/28/7820793.pdf
    • https://buwigonesopoxiv.weebly.com/uploads/1/3/0/2/130272084/5946376.pdf
    • http://chynnaalexandraphotography.com/uploads/1/3/0/6/130622025/3648696.pdf
    • http://moonrisetours.com/uploads/1/3/0/6/130605471/9709018.pdf
    • http://northeastmaterials.com/uploads/1/3/0/5/130588145/pupenebob_musegurenuduru_kaxarilivukokaz_livawi.pdf
    • http://cardsmovinginc.com/uploads/1/3/0/5/130590235/mojoxazipoxix.pdf
    • http://ziso.volkanarslan.net/uploads/2020/01/27/sovikifabojajit.pdf
    • http://kowofe.mestoryonline.ru/uploads/2020/01/28/wuvakefureduvu.pdf
    • http://racingshoxsweden.com/uploads/1/3/0/5/130539341/8dfe700c10ed9.pdf
    • http://vagu.servicemyaccount.net/uploads/2020/01/28/2d402a12c2d3f5.pdf
    • http://pazibarul.cabinet-otpbank.info/uploads/2020/01/27/9662921.pdf
    • http://rocnifinland.net/uploads/1/3/0/5/130550706/netagu.pdf
    • http://qeisolutions.com/uploads/1/3/0/5/130551229/9579008.pdf
    • http://12x-hybridmuscle.com/uploads/1/3/0/6/130604892/f6098b.pdf
    • http://ctmelectricinc.com/uploads/1/3/0/2/130289410/270878.pdf
    • http://nashobavalleyextractco.com/uploads/1/3/0/4/130488811/130488811.html#vcenter+6.+0+u1

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016c8.bin
41e4b28bd03807b85068e2bf1e3ee2ffd9d281f26cb81dfd18941830844d12ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16C8 8332 bytes
font_01_sfnt_off00007226.bin
8a594de7be5b87d941ca8bcdc8d216e4dc1b1c3e8bb0e32005742db44a66a11f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7226 4680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.