Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e5d02a2bcb849a7…

MALICIOUS

PDF

42.7 KB Authoring application: pdf-parser
MD5: 4983e2ed0ab5cc39e9a5f9d8a7ebfa5f SHA-1: 13bb1466a5dcc6737c9f8492061445fbf42eb213 SHA-256: 1e5d02a2bcb849a7b9e3d2b84e555e07a7300d6dc0f965bec8b9726a593759ed
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits characteristics of a phishing lure, as indicated by the 'PDF_SEO_LINK_FARM' heuristic firing. This heuristic detected a large number of external links embedded within the document, pointing to various domains. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. The primary intent appears to be redirecting users to potentially malicious content hosted on these external URLs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ztkarl.com/uploads/1/3/0/4/130475955/239469.pdf
    • http://mozotu.cloudycherry.net/uploads/2020/01/28/wofanezusipob-bujisowobisad.pdf
    • http://carolinegadsby.com/uploads/1/3/0/4/130483973/671b8f20.pdf
    • http://shenprayer.club/uploads/1/3/0/6/130639739/9921075.pdf
    • http://tof.parfumes.ru/uploads/2020/01/28/kamafuvu.pdf
    • http://myempoweringyouth.com/uploads/1/3/0/7/130739349/diwexofonagap-wirab-lavir.pdf
    • http://itsmrjack.com/uploads/1/3/0/6/130604765/7476115.pdf
    • http://midwestairsoftgroup.net/uploads/1/3/0/5/130544136/3112579.pdf
    • http://myecns.com/uploads/1/3/0/4/130476192/1375144737fa.pdf
    • http://absystemsllcscam.com/uploads/1/3/0/2/130289238/130289238.html#means+of+foreign+language+teaching+to+young+learners

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013ae.bin
6c2fee75eb1b4d92b0af4feb0fc079e318abeee886487e5d6473ce5e3df566c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13AE 7716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.