Malicious PDF — malware analysis report

Static analysis result for SHA-256 f14921a5254f31ba…

MALICIOUS

PDF

57.1 KB Authoring application: pstoedit
MD5: 6f90f45d9afcc74edf6a89f3cfdcae1d SHA-1: cb233357effe90a31ee36f85c21d2391da269365 SHA-256: f14921a5254f31ba26af914492cbd2f79421f1db0c27a1297dbdf9f432518a17
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a technique commonly used in phishing campaigns to redirect users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nudevember.net/uploads/1/3/0/6/130604181/lurutegigutalu_riripulup.pdf
    • http://saintmichaelsdowntown.com/uploads/1/3/0/3/130324203/c049f3cdc3fc5.pdf
    • http://www.embassyrowmansion.com/uploads/1/3/0/7/130739224/77d7f4731d.pdf
    • http://joblanta.com/uploads/1/3/0/5/130544387/dozuz.pdf
    • http://mikeandmemes.com/uploads/1/3/0/6/130621370/570496.pdf
    • http://g5livestockllc.com/uploads/1/3/0/7/130775413/pudukezakiturize.pdf
    • http://www.winnipegcrimestoppers.com/uploads/1/3/0/4/130483871/kogoxebop-nopuwam-naxibuzofex.pdf
    • http://techtransconsult.com/uploads/1/3/0/8/130874304/lesedijomase_jizapujap_fugolaw_fewesobowojo.pdf
    • http://aquaticsspace.com/uploads/1/3/0/6/130639363/genefa.pdf
    • http://thedirectcorp.com/uploads/1/3/0/3/130313005/sepogiwixiwosod.pdf
    • http://aquase.net/uploads/1/3/0/7/130740097/veduxuxam-xorat.pdf
    • http://www.stamfordham.biz/uploads/1/3/0/3/130379381/narizizaje_novoxan.pdf
    • http://hmmmdesign.co.uk/uploads/1/3/0/2/130288326/vigetidazitop.pdf
    • http://royalsingalongparties.com/uploads/1/3/0/5/130589309/fuperugedizore_tugaxugezitirik.pdf
    • http://pathproduct.com/uploads/1/3/0/6/130605107/xuxawana.pdf
    • http://www.sunshinepastasauce.com/uploads/1/3/0/4/130436173/d95dfc01979ec64.pdf
    • http://slaten-wedding.rominastiebenphotography.com/uploads/1/3/0/5/130551809/130551809.html#causes+of+anemia+in+kidney+transplant+patients
    • http://tcwsdrn.sites.looka.com/uploads/1/3/0/5/130588150/675252d8a06e601.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067f3.bin
ef4c4a53e15cc40d35ad5b238a618e4f5c3b9a8842dfde4e8007a059a9de2e93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67F3 16204 bytes
font_01_sfnt_off0000803e.bin
e7fe46ff1bc3857d6dce51fff5761aeccc9c0d4ec6ca3d7913d37e08f8b2b8cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x803E 9232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.