Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f7fb4535e262256…

MALICIOUS

PDF

33.8 KB Authoring application: Smallpdf Desktop
MD5: 52c905fb9a24faa03ec8a66e98ba5616 SHA-1: 8a7708127174147eeed77c22a6700162c8344b58 SHA-256: 3f7fb4535e2622560fcc69d6450916a63f552f915b0ec3de936f192245eca19c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to suspicious domains. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection intent. The document body, though partially corrupted, mentions 'letter template pdf', aligning with the SEO link farm heuristic which aims to attract users searching for such documents. The primary malicious URLs are identified as IOCs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mupiwixej.hotelimperiya.ru/uploads/2020/01/28/7013666.pdf
    • http://seubluray.com/uploads/2020/01/28/josugijagipelibak.pdf
    • http://vetriks.com/uploads/2020/01/28/gufugil.pdf
    • https://nogevetame.weebly.com/uploads/1/3/0/4/130435805/kugijuravafum-nafunorupipa-zigiwekiguwofe-pegiduzaw.pdf
    • https://bopaxorik.weebly.com/uploads/1/3/0/3/130313057/makodika.pdf
    • http://mobileautorepairbend.com/uploads/1/3/0/5/130541552/6229785.pdf
    • https://gizofunevisen.weebly.com/uploads/1/3/0/3/130313156/5415569.pdf
    • https://sofadoluvutezos.weebly.com/uploads/1/3/0/5/130588203/427677.pdf
    • http://nexisnailsystems.com/uploads/1/3/0/5/130589100/130589100.html#printable+609+letter+template+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001198.bin
880a41ba674a372f4e1117273483deeee4c84811cfcd62bc5983f881e30d36e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1198 7864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.