Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c19883dd0809a0e…

MALICIOUS

PDF

37.4 KB Authoring application: pdf-parser
MD5: 84d0267200982f3f87cb198bf0b0c2f6 SHA-1: f98f95e59b3d2fee3f9da1dbdfa9e3408ceed2e9 SHA-256: 3c19883dd0809a0e10785683e85a02354b324e2e19835fc695fe6a8d9ce531d9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique commonly used for SEO poisoning or to redirect users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body text is heavily obfuscated and does not provide clear user-facing content, but the overall structure and heuristic firings strongly indicate a malicious link farm designed to lead users to potentially harmful sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mothersfx.com/uploads/1/3/0/4/130488861/wamovofofuxiru.pdf
    • http://jacobsentape.com/uploads/1/3/0/5/130589213/jowin.pdf
    • http://zoningatl.com/uploads/1/3/0/5/130552016/b215927.pdf
    • http://stripclubsnetwork.com/uploads/1/3/0/6/130639504/9755178.pdf
    • http://newaplusenvironmentalrestoration.com/uploads/1/3/0/5/130588964/9284950.pdf
    • http://ns2.goldendark.net/uploads/1/3/0/2/130274199/4321845.pdf
    • http://goddesswisdom.net/uploads/1/3/0/5/130590400/823be9d4009d0.pdf
    • http://clinicademedicinafetal.com/uploads/1/3/0/5/130588754/dodoxupelot.pdf
    • http://castawaycustomsmidwest.com/uploads/1/3/0/3/130313037/lanewisevub.pdf
    • http://interstellarbrands.com/uploads/1/3/0/5/130551782/wiwikowulumabum.pdf
    • http://jp.thesuites-taitung.com/uploads/1/3/0/7/130776096/menuduxuke_wajusazizipetor.pdf
    • http://new-style-trailer.com/uploads/1/3/0/6/130639779/fixisebefak.pdf
    • http://www.crystalclassicphotography.com/uploads/1/3/0/5/130540033/b33da.pdf
    • http://oceania28.ru/uploads/1/3/0/6/130639775/5931555.pdf
    • http://thevictressvegan.com/uploads/1/3/0/2/130274267/79c31ba4e09c2.pdf
    • http://nathanrpt.com/uploads/1/3/0/5/130543148/0acd164.pdf
    • http://www.lexicology.info/uploads/1/3/0/8/130873735/rexalezofuris.pdf
    • http://novamedia.dk/uploads/1/3/0/4/130435601/bigalojix_zajameduxepuxe_videjopajixo.pdf
    • http://dominguesandkane.com/uploads/1/3/0/7/130739223/luzewanaluni.pdf
    • http://beginning-anew-in-the-lowcountry.com/uploads/1/3/0/2/130274076/leriruvusepifalis.pdf
    • http://jasonchou.net/uploads/1/3/0/7/130775470/mitizoto-dewiz-pizedabiki-raxusidukidavun.pdf
    • http://slaten-wedding.rominastiebenphotography.com/uploads/1/3/0/7/130775726/130775726.html#dowry+prohibition+act+2018+bangladesh

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032bf.bin
abe228a8ac30a0d504b6ceb68884ae6ce699a7663c27f3343864ae5df2cc7b33		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32BF 7504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.