Malicious PDF — malware analysis report

Static analysis result for SHA-256 3df412c9d8e8ba8b…

MALICIOUS

PDF

57.3 KB Authoring application: QPDF
MD5: 3cab229b9cf7575a6e76a5baac098461 SHA-1: 4238b762dab14e716b3d1db4134ab335f13d34dc SHA-256: 3df412c9d8e8ba8bdfb7897c212a3c6a578496c6b7ac6ba8d1264a18ae55ab12
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting an attempt to manipulate search engine results or redirect users to malicious sites. ClamAV also detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', reinforcing its malicious nature. The presence of a 'SE_DOWNLOAD_BUTTON' heuristic further indicates a lure to encourage user interaction with the embedded links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://solarenergybrokerinc.com/uploads/1/3/0/5/130588279/botekorov-gumaz-welosavifupupan.pdf
    • http://jamesmustafa.com/uploads/1/3/0/8/130874389/mumeganekege.pdf
    • http://bottegavesuviana.com/uploads/1/3/0/2/130289448/f624a7d89.pdf
    • http://mindbodyhealthcoaching.com.au/uploads/1/3/0/5/130550681/2525537.pdf
    • http://www.carlyberg.com/uploads/1/3/0/3/130313161/9879478.pdf
    • http://heythatsagreatidea.com/uploads/1/3/0/3/130313471/vebojuwetera-ledijav.pdf
    • http://www.catch5alive.com/uploads/1/3/0/3/130323479/zanodowudakuv.pdf
    • http://thechurchchoirloft.com/uploads/1/3/0/5/130539446/305975.pdf
    • http://fakeangels.space/uploads/1/3/0/7/130739143/vilixekabobij-povur.pdf
    • http://www.sense-mindful.com/uploads/1/3/0/6/130605012/33de8ed0c01.pdf
    • http://pitwagner.com/uploads/1/3/0/8/130874536/871322.pdf
    • http://online-wealth-college.com/uploads/1/3/0/2/130270903/69b85.pdf
    • http://daniel-stripedtiger.com/uploads/1/3/0/2/130291783/4506181.pdf
    • http://neurology-u-tokyo.com/uploads/1/3/0/7/130775904/buvivalokurafedu.pdf
    • http://tirus.io/uploads/1/3/0/5/130551562/fodamuvaroxa.pdf
    • http://mrsrosatosclass.com/uploads/1/3/0/3/130323437/refagaz.pdf
    • http://thewaves.site/uploads/1/3/0/9/130969278/tevuwidizotuzikolinu.pdf
    • http://wavradio.org/uploads/1/3/0/6/130640091/779674.pdf
    • http://quantuminstruments.com/uploads/1/3/0/8/130813373/ec125d16.pdf
    • http://huangguanwangxiazhujidian.f18.ebkf.org/uploads/1/3/0/6/130605440/tabupaza-gukogugos.pdf
    • http://animalcomeback.com/uploads/1/3/0/6/130621191/5681481.pdf
    • http://a1982767xstreamtravel.xsideas.com/uploads/1/3/0/3/130313336/130313336.html#kaplan+f5+revision+kit+2018

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c8d.bin
696bdcee8fbc902021214a3f19b685da097fb690f390baee6290127e8b477be5
pdf-font-stream PDF embedded font (sfnt) at offset 0x3C8D 18060 bytes
font_01_sfnt_off0000583c.bin
17c16ceb714385a5d8506e469f96300699ff97667f077ddd4d29b41a33b7472b
pdf-font-stream PDF embedded font (sfnt) at offset 0x583C 15784 bytes
font_02_sfnt_off00007e73.bin
9c3812b1e2b75f09abe844c6e7fe5e6a65d6b42e2211a549512a161182d83f6b
pdf-font-stream PDF embedded font (sfnt) at offset 0x7E73 8552 bytes