Malicious PDF — malware analysis report

Static analysis result for SHA-256 4999d3f2f9dbf1ce…

MALICIOUS

PDF

46.3 KB Authoring application: Mobipocket Creator
MD5: 5313161e36d2532c06cd80c21ac0f413 SHA-1: 6783bd9556aed181c3f0a85992c79164f9f0dc3f SHA-256: 4999d3f2f9dbf1ceb78f51a293088ce38967e38c52ce43ee7268404b2f43be75
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall. Static analysis revealed a large number of embedded URLs, indicating a link farm designed to redirect users to potentially malicious content. The primary heuristic firing, PDF_SEO_LINK_FARM, confirms the presence of numerous external PDF links, with 'qayl.club' being a dominant host. The document body, though partially corrupted, contains text related to 'Mobipocket Creator' and 'fingerstyle songs', likely a lure to disguise the malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://qayl.club/uploads/2020/01/28/3107aa.pdf
    • http://school7u-u.ru/uploads/2020/01/28/bagegosunov_fuxovabanaf.pdf
    • http://myers-adams.com/uploads/1/3/0/4/130435732/77d750ef11fe01f.pdf
    • http://nodeberiacontarlo.com/uploads/1/3/0/2/130287883/pasosojisom-pilifububefe.pdf
    • http://beviwuvoju.hayatimbirfilm.com/uploads/2020/01/27/3fc58e0cf.pdf
    • https://nasuloxo.weebly.com/uploads/1/3/0/2/130289421/d4754e7521.pdf
    • http://firetailers.com/uploads/1/3/0/6/130620266/f270b76a4.pdf
    • http://decheapertrash.com/uploads/1/3/0/5/130589186/zegikaxa-gudivewaposamak-kimusubugo.pdf
    • http://map.sloto-cash.ru/uploads/2020/01/28/9853644.pdf
    • http://roxandsol.com/uploads/1/3/0/6/130604009/zifebogik-luxifojanu-pafefa-tabix.pdf
    • http://wigglebottomaussies.com/uploads/1/3/0/2/130289327/2b99816c708.pdf
    • http://melirodem.moskovskiepotolki.ru/uploads/2020/01/29/427786.pdf
    • http://nlpcoursesmelbourne.com/uploads/1/3/0/3/130313513/navatasa.pdf
    • http://beyourbe.com/uploads/1/3/0/2/130288479/livezenovuvetar_bibimedar.pdf
    • http://sacredhearts.ca/uploads/1/3/0/5/130538985/3811776.pdf
    • http://nicole-bramble-illustration.com/uploads/1/3/0/6/130604420/7379940.pdf
    • http://mimiscoffeehouseofhardwick.com/uploads/1/3/0/5/130551330/pimanugepebi_latusolam.pdf
    • http://thevisualnarrative.com/uploads/1/3/0/5/130543402/f1d1c523dc3d.pdf
    • http://treehousebellaire.org/uploads/1/3/0/6/130639868/tebaperidebejixi.pdf
    • http://woundedwarriorpokerrun.com/uploads/1/3/0/4/130477064/3076003.pdf
    • http://kraftstone.ru/uploads/2020/01/28/6977227.pdf
    • http://kude.new-m2.ru/uploads/2020/01/28/ponulunanoga.pdf
    • http://wefesi.steuerschroeder.com/uploads/2020/01/27/ziwazokaxujozuz-nadika-saripujalelo-gesafep.pdf
    • http://jessicabrownmusic.net/uploads/1/3/0/6/130621675/nabedidofovuva.pdf
    • http://tabezazon.tdsleads.icu/uploads/2020/01/28/504b2d5.pdf
    • http://neokundalini.org/uploads/1/3/0/5/130550665/130550665.html#easy+fingerstyle+songs+guitar

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000181f.bin
4775a7e132658734d10ca454ce303a83467baa7062e1ae99ab06b6fb221e4a59		 pdf-font-stream PDF embedded font (sfnt) at offset 0x181F 8620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.