Malicious PDF — malware analysis report

Static analysis result for SHA-256 1cae37bd432d870e…

MALICIOUS

PDF

45.9 KB Authoring application: PDF Studio
MD5: 503f887e8cd867492d52f96ad191e1e8 SHA-1: 6c19026c6230d4f22c55f9a5857c7f4f3e174543 SHA-256: 1cae37bd432d870e86d476e4d434bbb29527aca7a131d07b135f4545ebea5b36
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files hosted on external domains. The document body text, though partially corrupted, contains phrases like 'Te presento a laura pelicula completa gratis', suggesting a lure to entice users to click the links. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a phishing or malicious redirection campaign.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://petersand.net/uploads/1/3/0/6/130639822/d92aaf698c.pdf
    • http://76forums.com/uploads/1/3/0/6/130621926/d6361ba21d6ce.pdf
    • http://fitobochkaspb.ru/uploads/2020/01/28/vobow-gelukenukedu.pdf
    • http://tressieschneider.com/uploads/1/3/0/4/130478438/junezopulawil.pdf
    • http://doylestcafe.com/uploads/1/3/0/4/130435710/1738111.pdf
    • http://kobure.cmcindia.org/uploads/2020/01/28/felewukefowumamajiwu.pdf
    • http://nspiresalonatx.com/uploads/1/3/0/6/130621225/4898844.pdf
    • http://mycarlrogers.com/uploads/1/3/0/5/130539642/borevofuwa_pegobode_wasij.pdf
    • http://renownedvisionariesunited.world/uploads/1/3/0/2/130291769/7950731.pdf
    • http://moodlabnewlife.nl/uploads/1/3/0/2/130270768/130270768.html#te+presento+a+laura+pelicula+completa+gratis

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000129b.bin
ea3254aed72dcd3495d05c0e92b799bd30b426aca26ed3b3d5bce8451d752437		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129B 9836 bytes
font_01_sfnt_off000061cb.bin
ec0c25cf0f2f39e84d264daed4e44a7a6d99103d182504097919b4edc8624eac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61CB 16636 bytes
font_02_sfnt_off00007813.bin
bd826571aa370a1c9fcd4f02f0b1f1b2f87ad8523ff338b0175677accfbffba3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7813 2684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.