Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a969b025d9b448d…

MALICIOUS

PDF

50.6 KB Authoring application: Serif PagePlus
MD5: 7aeb2ef26c5ead96e875ebeb0889aa79 SHA-1: 08d5b76449d54add9cc66319fe888584ff9bdb89 SHA-256: 2a969b025d9b448d45a4744804548293977a0d6c2f1122462a5d2b0533da1ae9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on various domains. The heuristic PDF_SEO_LINK_FARM indicates a mass external link farm, suggesting a tactic to manipulate search engine results or distribute malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nekixase.shoppohudenie.ru/uploads/2020/01/27/9eccc67238.pdf
    • https://malolibefol.weebly.com/uploads/1/3/0/4/130489248/buboladol.pdf
    • http://kasom.goriteam.xyz/uploads/2020/01/28/rokogim.pdf
    • http://xafuveku.kuhni-msc12.icu/uploads/2020/01/28/7820477.pdf
    • http://muf.toutusage.com/uploads/2020/01/28/c5ae82624a18f12.pdf
    • http://kisuzapp.com/uploads/2020/01/27/suzedowiluxekoxarog.pdf
    • https://wasubobopaxuriz.weebly.com/uploads/1/3/0/6/130604281/lawesawatu.pdf
    • http://mikegfitch.net/uploads/1/3/0/5/130588151/zelige.pdf
    • https://zopolutena.weebly.com/uploads/1/3/0/5/130543394/gulipudevarakusig.pdf
    • http://zitesideda.sloto-cash.ru/uploads/2020/01/28/jefiku.pdf
    • https://tinomoduju.weebly.com/uploads/1/3/0/3/130379069/pogexof-teveboxapiwiru-xogonokomejoje.pdf
    • http://rajaf.smt-hb.ru/uploads/2020/01/29/noxuxepolapu-fatapezabatuf-bakoxupu-divumemifo.pdf
    • http://tedim.mymobiledriver.com/uploads/2020/01/27/3966084.pdf
    • http://aseralle.me/uploads/2020/01/28/028eb329.pdf
    • http://jawozo.golie.icu/uploads/2020/01/28/ae91c04e8fa436.pdf
    • http://roxandsol.com/uploads/1/3/0/2/130270934/ribajuka-wofuk.pdf
    • https://dujazutekositi.weebly.com/uploads/1/3/0/5/130590058/2447909.pdf
    • http://fute.showskazka.ru/uploads/2020/01/27/88621.pdf
    • http://madzladz.com/uploads/1/3/0/3/130313103/130313103.html#pokemon+sun+and+moon+walkthrough+book

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001585.bin
8683b9cfd8a3bd2718cdf55f1d48279d40b411480c2907b78604f5d72306d2f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1585 8932 bytes
font_01_sfnt_off000073df.bin
3eb4b2cea5944beed14372be996492f8da05ecb2c2a1d392e04caf7671f8bd8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73DF 10720 bytes
font_02_sfnt_off00008a75.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A75 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.