Malicious PDF — malware analysis report

Static analysis result for SHA-256 4252d2031ad08443…

MALICIOUS

PDF

36.1 KB Authoring application: QPDF
MD5: fee06f2f25e053abafe4160eaa4d4eb2 SHA-1: 569ead348f821c859fba8bb805ff1901eb20ae05 SHA-256: 4252d2031ad084434054819868dd68e7adfec6023bb84d982b9ee05966642e72
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or spamming intent. The embedded URLs are likely used to redirect users to malicious content or further phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zoxavabagabop.weebly.com/uploads/1/3/0/5/130551258/xofosabem.pdf
    • https://lupanugotan.weebly.com/uploads/1/3/0/4/130488087/zupaposevijuwor.pdf
    • http://vipogodowe.janderu.xyz/uploads/2020/01/28/dc9047f9f321f2.pdf
    • http://canadianholisticcenter.com/uploads/1/3/0/4/130488816/9a9dd6d4592.pdf
    • http://shirntechgroup.com/uploads/1/3/0/6/130621167/wufajawepaluru-vubebu.pdf
    • http://vr-journal.ru/uploads/2020/01/29/xovinomurudivaf.pdf
    • http://christineliboon.com/uploads/1/3/0/6/130620428/momakak-xidolujebawili.pdf
    • http://kav.otdelka-moscow.com/uploads/2020/01/27/nadekaxobo.pdf
    • http://mynaturalplace.org/uploads/1/3/0/5/130588168/bawigab.pdf
    • http://smsmetais.site/uploads/2020/01/28/fumuwa.pdf
    • http://bearofrosess.ru/uploads/2020/01/27/jafufipek.pdf
    • http://nim.sonxequyentri.com/uploads/2020/01/28/zorameg_rikuwurogawasok_zeruluj.pdf
    • http://jota.missannamariebarrios.site/uploads/2020/01/28/9062065.pdf
    • http://keepdivealive.com/uploads/1/3/0/4/130488069/3184232.pdf
    • http://ridufo.ladies.wine/uploads/2020/01/27/joruj.pdf
    • http://mountforesthomecoming.ca/uploads/1/3/0/5/130588672/9175336.pdf
    • http://accadulthomecare.net/uploads/1/3/0/3/130323896/xeniwev_gemivuxatab.pdf
    • http://dancinggoatsanctuary.com/uploads/1/3/0/4/130478609/130478609.html#barren+island+information

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001469.bin
9d536b3054c6e600b677eafdbb310d195bb5cc78a7d9b2a18e7430da843cd5e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1469 7472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.