Malicious PDF — malware analysis report

Static analysis result for SHA-256 26c0c541929263e3…

MALICIOUS

PDF

124.6 KB Authoring application: Adobe PDF Library 9.0
MD5: 69e514dac563010af0951bb37fb0a0f3 SHA-1: 672436b7bf5b26c861ab6f3da4f3c31914799db0 SHA-256: 26c0c541929263e3e205e49e2cd3794206958607b553df75f650e2d6db9dc85d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious File: Malicious Link

The PDF file contains a large number of embedded URLs, identified as a link farm, which is a common technique for SEO manipulation or distributing malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious traffic redirection intent. The primary URLs identified are likely part of this malicious infrastructure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://klaspinfo.com/uploads/1/3/0/3/130323471/f3ca4bc.pdf
    • http://tel.lechenienarkomanii-blagoveshhensk.ru/uploads/2020/01/27/guzarepilafako_dawulifajuw_gisedelixiwe_jonafimetadozez.pdf
    • http://werajidinu.agicole-acces.com/uploads/2020/01/29/4061037.pdf
    • http://ricksmobilerv.com/uploads/1/3/0/2/130289603/dc2c67e241c548.pdf
    • http://managewisconsin.com/uploads/1/3/0/5/130588216/rubalogagozu.pdf
    • http://jowetofobo.suot.pro/uploads/2020/01/28/xiradolunivi.pdf
    • http://nonigexoxe.multimodal.pro/uploads/2020/01/27/gorilepe-vekipo.pdf
    • https://zarapugu.weebly.com/uploads/1/3/0/2/130289222/xezunawi.pdf
    • https://birumeragam.weebly.com/uploads/1/3/0/5/130588187/6e388a0c34fe9a7.pdf
    • http://thefantasyparis.com/uploads/1/3/0/3/130312985/jirumexatin.pdf
    • http://stellamarisenvironmentalresearch.com/uploads/1/3/0/2/130288338/f170f096b67d0bf.pdf
    • http://bidutifaso.hercareer.pro/uploads/2020/01/29/3433008.pdf
    • http://adamholtindustries.com/uploads/1/3/0/5/130588943/c60f2b924d5.pdf
    • http://tdorestoran.ru/uploads/2020/01/29/7127506.pdf
    • http://puposol.moo.moscow/uploads/2020/01/28/4334357.pdf
    • http://thebestpillowever.com/uploads/1/3/0/2/130291589/9afd65d152f6a6.pdf
    • https://nuguruti.weebly.com/uploads/1/3/0/4/130488812/wuxelew.pdf
    • http://mobileonegaming.com/uploads/1/3/0/5/130588714/130588714.html#advanced+language+practice+3rd+edition+answer+key

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000168d.bin
d41828eb478bbf72b291c800431bc4a35a24ff3162a430b9c62822102aecba25		 pdf-font-stream PDF embedded font (sfnt) at offset 0x168D 9000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.