Malicious PDF — malware analysis report

Static analysis result for SHA-256 306d7a711d06e975…

MALICIOUS

PDF

40.9 KB Authoring application: Smallpdf Desktop
MD5: 3d112ba7ad06e85492673b3204c430d3 SHA-1: ea584405afc049af9ce998e1a0c4be92e0609e1b SHA-256: 306d7a711d06e975115cd10dc14965d3b2e4b54c760e4c3b3b655ed16a765fbd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall. Static analysis revealed a large number of embedded external links, indicative of a link farm or redirection scheme. The primary malicious URL identified is http://rija.segundamorada.com/uploads/2020/01/29/2811797.pdf, which is likely used to host or redirect to further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rija.segundamorada.com/uploads/2020/01/29/2811797.pdf
    • https://xopilavuxuneki.weebly.com/uploads/1/3/0/6/130604737/6be0985481.pdf
    • https://denafapaguv.weebly.com/uploads/1/3/0/5/130541688/514195.pdf
    • http://catholicfamily-games.com/uploads/1/3/0/5/130550881/547184fab8380.pdf
    • http://cinderellacares.com/uploads/1/3/0/5/130539679/nigonagaxamemupox.pdf
    • http://7315robotics.com/uploads/1/3/0/5/130589228/4064706.pdf
    • https://laseragapotepi.weebly.com/uploads/1/3/0/4/130476830/poninebimasaneme.pdf
    • http://lamenej.zotye-t600.ru/uploads/2020/01/28/wubobopigi-xinatojigix-senozininipi.pdf
    • http://alfnevents.org/uploads/1/3/0/6/130621292/jevowanuvulugebere.pdf
    • http://pipuwuzol.gentlyhug.com/uploads/2020/01/28/ff5eba33.pdf
    • http://sofa.foodtrucksquare.com/uploads/2020/01/28/8193601.pdf
    • http://a1protx.com/uploads/1/3/0/6/130620813/e916db76e4ba.pdf
    • http://bupa.nakff.net/uploads/2020/01/28/rumexozepibugul_gejofifiwabebat.pdf
    • http://36exp.org/uploads/1/3/0/5/130590567/tulebe_kedamaf_xakuzubalu.pdf
    • http://holdenshouseco.com/uploads/1/3/0/5/130589415/7460374.pdf
    • http://lynalen.com/uploads/1/3/0/4/130436494/0191d2d9.pdf
    • http://becuebrand.com/uploads/1/3/0/5/130590464/fiwapu.pdf
    • http://doju.tutotchet.ru/uploads/2020/01/28/xapevejorugimusuxala.pdf
    • https://dudalumivurox.weebly.com/uploads/1/3/0/2/130289247/220b02f9dd0227.pdf
    • https://kejekodejufav.weebly.com/uploads/1/3/0/5/130543386/3903170.pdf
    • http://psychotherapy121.net/uploads/1/3/0/3/130323717/130323717.html#ternary+relationship+erd

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015c3.bin
30db57c6f1a8cacd21a02a40252a6b1f1a95fd8b700d7a2380a5827a05b1ff56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15C3 7804 bytes
font_01_sfnt_off000063fc.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63FC 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.