Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb3c3b1a9a7a6262…

MALICIOUS

PDF

45.7 KB Authoring application: Soda PDF
MD5: 8252255066f2f1273637f2bbf7d29d75 SHA-1: 524fbbcf54cd596973eac069f2929cf0b9c868f3 SHA-256: fb3c3b1a9a7a6262174c374b4adc47c67435944796d0e2dd573eea666cdd0f9a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified as a link farm, which is a common technique for distributing phishing content or malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious intent. No scripts were extracted from this sample, but the extensive link farm suggests the primary goal is to redirect users to malicious sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://audiopron.com/uploads/1/3/0/5/130588681/8f91310865.pdf
    • http://feijoasarefabulous.com/uploads/1/3/0/8/130814104/botesebekutekix.pdf
    • http://riverportlandscaping.com/uploads/1/3/0/5/130588263/6067009.pdf
    • http://cygnetsmagazine.com/uploads/1/3/0/6/130639861/c6871f8a8253f19.pdf
    • http://smokyrex.com/uploads/1/3/0/3/130379114/ad40c1fa2043a28.pdf
    • http://temperamentsart.com/uploads/1/3/0/4/130435895/3038309.pdf
    • http://amandatarsiuk.com/uploads/1/3/0/4/130483041/2266210.pdf
    • http://allsd.co.nz/uploads/1/3/0/5/130545998/c92bf6.pdf
    • http://church-playgroundequipment.com/uploads/1/3/0/6/130604511/867432.pdf
    • http://jacktaggart.com/uploads/1/3/0/3/130379561/5aa3172f9de2.pdf
    • http://acrowscalling.com/uploads/1/3/0/7/130776042/wazegebakapimeb.pdf
    • http://sxsw360.com/uploads/1/3/0/6/130639747/317f898.pdf
    • http://farmtablecatering.ca/uploads/1/3/0/5/130547884/tinowon_lewolikele.pdf
    • http://555-bonus.space/uploads/1/3/0/7/130738555/lekex-xukobomomoja.pdf
    • http://competetennismerchandise.co.uk/uploads/1/3/0/4/130436180/bca7b6bfc13b9.pdf
    • http://mountainshadowfarm.ca/uploads/1/3/0/7/130740492/1902202.pdf
    • http://thingraniteveneer.com/uploads/1/3/0/6/130604675/dolapelapib_xamefupekumumex_nufawosuteluda_jifupunudarilo.pdf
    • http://mertior.com/uploads/1/3/0/6/130639835/7aacb31.pdf
    • http://northforknews.net/uploads/1/3/0/5/130539370/5282838.pdf
    • http://lpqe5c.salon225.com/uploads/1/3/0/2/130289421/130289421.html#with+renal+compensation+for+respiratory+acidosis+the+ph+of+the+urine

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005338.bin
99919625aba24fc9f11331f1090dc440e1f2b828d2452a3bb2cdc1e45e34823e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5338 8412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.