Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff4ee990eac58e72…

MALICIOUS

PDF

44.0 KB Authoring application: PDFBox
MD5: 577d20c3a057ff6a7caa403b8da5da7f SHA-1: 4a2bec42f292c73be49074f563df1c0f16df515b SHA-256: ff4ee990eac58e720bc366572eaa075eb76a934e4518308189d77c82909da68a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The embedded URLs likely lead to further malicious content or phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stedwardschoolchristmastreefundraiser.com/uploads/1/3/0/5/130545021/f11f1f7caada92.pdf
    • http://bethwrightdesigns.com/uploads/1/3/0/5/130544303/cdb5eb.pdf
    • http://www.pampanga-properties.com/uploads/1/3/0/5/130551962/08c74543fa72def.pdf
    • http://servicedoffice.net/uploads/1/3/0/6/130604315/9567653.pdf
    • http://passionbrandingco.com/uploads/1/3/0/4/130483811/tomoxa.pdf
    • http://www.thekitchenonthecape.com/uploads/1/3/0/7/130739288/revad-xemobuvujuxer-gumubapeduximi.pdf
    • http://www.habetlercpa.ca/uploads/1/3/0/3/130313649/fotuwonoriwasuxuda.pdf
    • http://pricewaterhousecoopers.us/uploads/1/3/0/8/130813799/8981312.pdf
    • http://mail.rysymphony.org/uploads/1/3/0/7/130775520/zorelazedesom.pdf
    • http://bloggernj.com/uploads/1/3/0/5/130590582/bifogutasetawib_tunewiro.pdf
    • http://christopherhoadley.info/uploads/1/3/0/3/130324351/fokapiz.pdf
    • http://refreshingoasis.org/uploads/1/3/0/5/130538866/5288139.pdf
    • http://humanisingtheenterprise.com/uploads/1/3/0/5/130550830/5405387.pdf
    • http://www.809sitemedia.com/uploads/1/3/0/4/130488158/332f9.pdf
    • http://smokeboxheroes.com/uploads/1/3/0/3/130313368/dumajupevixebi_zomakuza_majura.pdf
    • http://gotcertifications.com/uploads/1/3/0/8/130814241/1788104.pdf
    • http://zhuanjia.bpmtc.com/uploads/1/3/0/5/130539238/130539238.html#online+grammar+test+on+active+and+passive+voice

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032e6.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32E6 2600 bytes
font_01_sfnt_off00003b74.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B74 16036 bytes
font_02_sfnt_off00005229.bin
38f2abccc3ba772b2442278e733c4d8771338cf77f41196848ad2e7613319148		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5229 7016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.