Malicious PDF — malware analysis report

Static analysis result for SHA-256 2803a26b66977a2e…

MALICIOUS

PDF

54.3 KB Authoring application: Inkscape
MD5: 5135817b30dcb479ae26d016bf39397f SHA-1: e036ebb912bbb6847f8c5803272e03e16cfe4c01 SHA-256: 2803a26b66977a2e7b4c4d1e44fccf4ac68bff9bffb5e93ffa9657a54a9f5f48
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, with the primary host being 'cleaalsip.com'. The document body, though partially corrupted, references 'Ipcc report 2018 october summary', suggesting a lure to a malicious website. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malware distribution intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cleaalsip.com/uploads/1/3/0/6/130639608/3834358.pdf
    • https://miforefafiwa.weebly.com/uploads/1/3/0/2/130272267/1007271.pdf
    • http://teamborkowski.com/uploads/1/3/0/2/130289354/3451039.pdf
    • http://fig.wpchoice.net/uploads/2020/01/28/ruwixidovo.pdf
    • http://joe-anime.net/uploads/2020/01/28/dofefir.pdf
    • http://cahoje.com/uploads/1/3/0/6/130639456/dc8f99c8988aa.pdf
    • http://xoglamaccess.com/uploads/1/3/0/3/130323894/pekanajepagiz.pdf
    • http://nfsparts.com/uploads/1/3/0/6/130639739/sagurepetukajupa.pdf
    • http://storystickies.com/uploads/1/3/0/6/130605452/neterukewojaxex.pdf
    • http://pogegraphicdesign.com/uploads/1/3/0/6/130604476/c5cfe1b2a823.pdf
    • http://bartolomeilaw.com/uploads/1/3/0/5/130541462/130541462.html#ipcc+report+2018+october+summary

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000126b.bin
97be1ce5f29e364bbbe266ef66e97729d72a3462faf00aa9b8113a7fb66e9627		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126B 8148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.