Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f713572d2ebbf77…

MALICIOUS

PDF

35.7 KB Authoring application: Serif PagePlus
MD5: 945e6374f3bccf54b5686e1300ba18bd SHA-1: c52395aa791a4101f05ef6c404f55e5aeae13d47 SHA-256: 1f713572d2ebbf77954e14534ac8fbb5dd24b3f1431f2eac59bc9675ebad9e96
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a malicious intent. The embedded URLs likely lead to malicious content or phishing pages, aiming to redirect users away from the current document.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://csobecancour-en.com/uploads/1/3/0/6/130604414/5282355.pdf
    • http://soulscriticalpath.com/uploads/1/3/0/5/130590403/9a444.pdf
    • http://livevugami.rollosolar.com/uploads/2020/01/28/c81d71ad406864.pdf
    • http://dobbsferryptsa.org/uploads/1/3/0/5/130551302/807670.pdf
    • http://5053lankershim.com/uploads/1/3/0/4/130488750/446d5d.pdf
    • http://grafixcity.com/uploads/1/3/0/7/130739443/zujuzuferuwerot.pdf
    • http://ogangii.com/uploads/1/3/0/6/130640081/tisaxupisatat-zufikakotakoj-bejafavuf-tojelapofigida.pdf
    • http://bashfitness.com.au/uploads/1/3/0/3/130379625/1967697.pdf
    • http://ndchair.com/uploads/1/3/0/7/130739235/130739235.html#acca+past+paper+taxation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011cf.bin
78cd21998ec73c2578195d2d7422a893a6c9fe73117a731536546886a7063a32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CF 8260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.