Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c84b4eb1d9e38a5…

MALICIOUS

PDF

39.2 KB Authoring application: Adobe PDF Library 9.0
MD5: 701f5abe9a309a7e7ac8e010aecaea2b SHA-1: 713ca181e6d335043f435269cf8fa040507788de SHA-256: 3c84b4eb1d9e38a5aaafa86dcdc0b7e19be9a899a8140732f2dbd79b33f99e7a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm or a phishing distribution mechanism. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The document body contains fragmented text and URLs, reinforcing the link farm hypothesis.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mmsestatelettings.com/uploads/1/3/0/3/130379206/6c82d17.pdf
    • http://genedi.transcom78.ru/uploads/2020/01/27/7483538.pdf
    • http://wivuw.stillika.ru/uploads/2020/01/27/d17c8398204b6d6.pdf
    • http://journeylutheranministries.com/uploads/1/3/0/4/130435500/2901463.pdf
    • https://ruzajufumetitat.weebly.com/uploads/1/3/0/3/130313495/3464928.pdf
    • http://degosidu.netto-tc.ru/uploads/2020/01/27/0d00065c3.pdf
    • http://wit.evroplast92.ru/uploads/2020/01/28/pefizeborakup_levutiwotulapip_meguvidesumu_padudogunowi.pdf
    • http://kupitonline.info/uploads/2020/01/28/3239835.pdf
    • https://sipurabi.weebly.com/uploads/1/3/0/5/130588651/7054f64c.pdf
    • http://kozopedugi.financebinom.info/uploads/2020/01/28/4894669.pdf
    • http://zazo.dda-russia.com/uploads/2020/01/29/gapusawe.pdf
    • http://mulekum.rkmw.ru/uploads/2020/01/28/a647add1.pdf
    • http://smithpointpartyrentals.com/uploads/1/3/0/6/130621570/xirugumaf.pdf
    • http://piwu.colorsun.ru/uploads/2020/01/28/kakuvumopotebemusimu.pdf
    • http://mukuluz.decodereadlearn.com/uploads/2020/01/28/dasumeniluxin.pdf
    • https://wafunelitidiko.weebly.com/uploads/1/3/0/5/130541133/5734205.pdf
    • https://xowuvibuwu.weebly.com/uploads/1/3/0/5/130550741/wepovam-nusebojozan.pdf
    • http://vipajagovo.coachesportivo.com/uploads/2020/01/27/kosipuzawejet.pdf
    • http://tofusefo.sietmexico.com/uploads/2020/01/28/vapinazo-kezufafe.pdf
    • http://juwexutik.expertmagnit.ru/uploads/2020/01/28/be6e839e10aa50c.pdf
    • http://bridgebuildingsupply.com/uploads/1/3/0/6/130603894/130603894.html#the+handmaid%27+s+tale+online+book+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015e8.bin
10c425fc1a1371ee4ba69a979062b9895bbe9a4803a2e9ccd88e11194812a6d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E8 7556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.