Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5091a4801a2f023…

MALICIOUS

PDF

79.3 KB Authoring application: Mobipocket Creator
MD5: ba61db71345558a62a9e2e4bc69c05a6 SHA-1: b66237599494d274c135dddbbf846043d1269def SHA-256: f5091a4801a2f023c30f9c21615c5fb1818e9ceb67c5e68b3e58ab55c3a259bf
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This technique is commonly used in phishing campaigns to distribute malicious content or redirect users to scam websites. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mkrbd.net/uploads/1/3/0/3/130323733/6371427.pdf
    • http://msaecr19.com/uploads/1/3/0/6/130621127/tusut-wedututokolame.pdf
    • http://weluckyfew.com/uploads/1/3/0/7/130740252/c68a1.pdf
    • http://milegion-legacyrun.org/uploads/1/3/0/2/130272432/9403743.pdf
    • http://djharperoldschool.com/uploads/1/3/0/5/130544898/9088896.pdf
    • http://seattlebarterexchange.com/uploads/1/3/0/4/130475877/ebc8df0.pdf
    • http://atlasaviation.org/uploads/1/3/0/2/130287295/dezekavevim-gofofolinu-lafenuxonixi.pdf
    • http://mty.news/uploads/1/3/0/5/130539255/xisiwagogub.pdf
    • http://thetri-fectagroup.com/uploads/1/3/0/5/130551091/fepatejutabi.pdf
    • http://alphagroupm.com/uploads/1/3/0/6/130621853/8767050.pdf
    • http://sahajmeditation.us/uploads/1/3/0/4/130478882/c750b0.pdf
    • http://deltaixsecurity.com/uploads/1/3/0/3/130313368/rokaxuzi_kisefi.pdf
    • http://proarbtreeservices.com.au/uploads/1/3/0/4/130476145/xibevi-kofefin-gukoxeperejib.pdf
    • http://pursuitofhappiness.live/uploads/1/3/0/2/130271085/92797a4.pdf
    • http://simscambodia.com/uploads/1/3/0/6/130639553/kizosifozuz.pdf
    • http://ayyamouvement.org/uploads/1/3/0/6/130639946/8f507d51b0d4cef.pdf
    • http://197cedarrock.com/uploads/1/3/0/6/130639856/fc1fe3bde2.pdf
    • http://www.christinahankinsart.com/uploads/1/3/0/2/130272355/7730258.pdf
    • http://flowironsolutions.com/uploads/1/3/0/6/130639030/bimosa-xijasanavuselu-nonox.pdf
    • http://xrdsfaith.com/uploads/1/3/0/2/130289774/dabujasezekafen.pdf
    • http://glebl.bpmtc.com/uploads/1/3/0/4/130476407/130476407.html#gta+5+money+cheat+xbox+1+story+mode

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000272c.bin
3334b850de47179f2ad7d2db165c1dbb2d31dabcccbe14ad1a63fe958802e488
pdf-font-stream PDF embedded font (sfnt) at offset 0x272C 9308 bytes
font_01_sfnt_off0000e026.bin
45c39c4315a5d00962143d4102937301eb2649728d6de39b959633cfc30365c3
pdf-font-stream PDF embedded font (sfnt) at offset 0xE026 16144 bytes
font_02_sfnt_off0000f4b6.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086
pdf-font-stream PDF embedded font (sfnt) at offset 0xF4B6 1708 bytes
font_03_sfnt_off0000fcbc.bin
adeff56123876f60748ea9b144a42fb68c4517528ca984778104f1eafcf97c21
pdf-font-stream PDF embedded font (sfnt) at offset 0xFCBC 2648 bytes