Malicious PDF — malware analysis report

Static analysis result for SHA-256 41bf616f5727e454…

MALICIOUS

PDF

49.5 KB Authoring application: Poppler-utils
MD5: 7478ec6f479fc423ed89fb09ed4d730e SHA-1: b27b77ba436a2084c600c3118b1c7d16016ed914 SHA-256: 41bf616f5727e4545e8202990337b623214c1851abaa988ad5b4ecf9590e0d2e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a PDF_SEO_LINK_FARM heuristic, indicating the presence of numerous external links. The document body contains a title related to a chemical reaction, but the primary malicious activity appears to be the mass distribution of links, likely to facilitate phishing or SEO abuse.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://composers.directory/uploads/1/3/0/6/130639941/pagadatilab.pdf
    • http://runninghorses.org/uploads/1/3/0/6/130620346/zeduj-tabin-subetu-jifep.pdf
    • http://cekyakonsoloslugu.net/uploads/1/3/0/2/130274017/tenavu-pisudexorov-ligukiduxisumi-tenerew.pdf
    • http://800us.net/uploads/1/3/0/4/130476340/govode-fidibifazov-xevebeku.pdf
    • http://zofe.fr/uploads/1/3/0/6/130605190/bisezelav.pdf
    • http://wuwup.bprofi.su/uploads/2020/01/28/gejoti_runatekoz_liwarigetasutus_begugukafakudup.pdf
    • http://stanleyskidsministry.org/uploads/1/3/0/4/130436141/130436141.html#ammonium+nitrate+and+water+reaction+equation

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013fe.bin
dcf973161a6712ff504e8b216107642d79e366994158f58369b3f4ace7386a7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13FE 9500 bytes
font_01_sfnt_off00008505.bin
cc1977fe6c99ad77c70841f8c0eb7df8c9d0a616afd206c9aba6b66e82a172f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8505 3460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.