Malicious PDF — malware analysis report

Static analysis result for SHA-256 f66a9e2433494a97…

MALICIOUS

PDF

38.2 KB Authoring application: QPDF
MD5: 48cc6516c6bed63a5c3024ca9d7513b4 SHA-1: 63dcc046b474760f93c9209181a30bd4a90581b4 SHA-256: f66a9e2433494a9727773537cfd2a933f5a17aae01381ba7ce132242b51d32e9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, many of which point to Weebly-hosted files, indicating a link farm designed to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious download campaign. The document body, though heavily obfuscated, contains references to movie downloads, likely a lure to entice users to click the malicious links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mskerksiekscience.weebly.com/uploads/1/3/0/6/130639743/aaa0924daea.pdf
    • http://californiacastaway.com/uploads/1/3/0/6/130621011/788124.pdf
    • http://nicoleshobertoems.weebly.com/uploads/1/3/0/4/130483866/bemaxaka.pdf
    • http://wells-fargo-losses.com/uploads/1/3/0/2/130288410/xolirogizamotiga.pdf
    • http://milesoftraining.com/uploads/1/3/0/3/130323727/kivezarizobapof.pdf
    • http://northbrisbanemortgagebrokers.com.au/uploads/1/3/0/6/130640119/683ade891acc34.pdf
    • http://krazy-verns-carwash.com/uploads/1/3/0/5/130589374/6874700.pdf
    • http://altasanacion.net/uploads/1/3/0/6/130604775/ruvimozidofivude.pdf
    • http://themindfulchristian.net/uploads/1/3/0/7/130739371/kutopabuf-lubelelabofa-wozunu-givizi.pdf
    • http://deitzlandsurveying.com/uploads/1/3/0/2/130287278/nonavorigufad_korufe_vogop.pdf
    • http://lavirgen.net/uploads/1/3/0/4/130483338/dagugareza.pdf
    • http://mysoundcollective.com/uploads/1/3/0/7/130775358/130775358.html#tamilrockers+avengers+endgame+movie++in+tamil

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001338.bin
b00f8a0dee8c77988064d3d90d668dc8528bdb6436df98f7a6b184ed8f42756c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1338 8468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.