Malicious PDF — malware analysis report

Static analysis result for SHA-256 492c986c1b248f93…

MALICIOUS

PDF

55.7 KB Authoring application: Pdftk
MD5: 8eff33972eadae5a5acc193369e9b367 SHA-1: 4783646f3a728ebb51a29412404fc1342ebc8fbc SHA-256: 492c986c1b248f93f8481ddf53f241e9660c58b06487ccde937cda48085a8911
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection further confirms its malicious nature, identifying it as Pdf.Phishing.TtraffRobotInstall. The embedded links are likely used to redirect users to malicious sites or to manipulate search engine results. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://levakura.weebly.com/uploads/1/3/0/3/130379479/positegoxadu-vigudilawa-burigudi.pdf
    • http://zebepe.amirhanov.com/uploads/2020/01/28/dbb7b57e6eac.pdf
    • http://hughsonchronicle.net/uploads/1/3/0/4/130483294/pekax-mepijogafugi-rosunod-jovarodupux.pdf
    • https://bovikonep.weebly.com/uploads/1/3/0/5/130590464/silewaweb_besujixoxanodi_vakuwexof_retuzuduwasil.pdf
    • http://jojeva.colt-russia.ru/uploads/2020/01/29/bowil_gojakur_zuzosezevakin.pdf
    • http://wawuf.onlineevents.tech/uploads/2020/01/27/sobebilitix_talokukumi.pdf
    • http://kim-barton.com/uploads/1/3/0/5/130539820/subiwow.pdf
    • https://tumikomev.weebly.com/uploads/1/3/0/6/130603896/jujarugemaxexamugugo.pdf
    • https://vekakoguroxi.weebly.com/uploads/1/3/0/2/130272440/8383609.pdf
    • https://kinutepexugupef.weebly.com/uploads/1/3/0/4/130436188/c6ed1ca.pdf
    • http://pagbo.ru/uploads/2020/01/27/vapasi.pdf
    • http://eetiklekkerwel.nl/uploads/1/3/0/2/130289474/130289474.html#the+isley+brothers+voyage+to+atlantis

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000136a.bin
513e6a4b887860ea3a30cbb6ca70cfdee7abc24eb12712f749495d4c34fb434f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x136A 8368 bytes
font_01_sfnt_off00008e62.bin
27b3af9b34e8fa6ccd575ab75396658c7207e813204a8b901c21f3a789104692		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8E62 17776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.