Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a4a090545f75813…

MALICIOUS

PDF

36.3 KB Authoring application: Pdftk
MD5: 9655ed33e374da8bbaca0e46a2f924b1 SHA-1: 6502b780998622e371bc3873dd2b9c3c8bac15a0 SHA-256: 4a4a090545f75813effb04451ed3a3fddca502c20fc1f22bd66f34198550dac5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

This PDF file functions as a link farm, directing users to multiple external PDF files hosted on various domains. The document body masquerades as a 'Boy scout of the philippines handbook pdf' to deceive users into clicking the embedded links. The heuristic 'PDF_SEO_LINK_FARM' and the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicate a phishing or malware distribution campaign.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nancyleong.com/uploads/1/3/0/6/130639538/jadusesudo.pdf
    • http://angiessnowhut.com/uploads/1/3/0/3/130313127/dilesavevupizet.pdf
    • http://bridge56.com/uploads/1/3/0/6/130604803/gojexexo-zapebi.pdf
    • http://scope-for-growth.com/uploads/1/3/0/3/130379069/4028622.pdf
    • http://cubriendocfl.net/uploads/1/3/0/6/130639739/sedoki.pdf
    • http://allincardhousesa.com/uploads/1/3/0/3/130323968/xagobukun-mugeji-gojamuwopeku-tubaxidolidezok.pdf
    • http://legacycreekgsmd.com/uploads/1/3/0/2/130287852/8963462.pdf
    • http://mrscooke.com/uploads/1/3/0/4/130489909/juxizaput_fawabawulo.pdf
    • http://fox.kinotani.icu/uploads/2020/01/28/667546ba.pdf
    • http://severedthumbsart.com/uploads/1/3/0/4/130436244/a8bd26391a135.pdf
    • http://castillocoin.com/uploads/1/3/0/6/130603975/5cb64b2600503.pdf
    • http://mikeintucson.com/uploads/1/3/0/5/130588936/130588936.html#boy+scout+of+the+philippines+handbook+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012b6.bin
3546cb438d516605c3c1595f1b24882d8893641fc6cb8fdeb6e1511410e97424		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B6 7636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.