Malicious PDF — malware analysis report

Static analysis result for SHA-256 524d4f09a273ccfd…

MALICIOUS

PDF

36.9 KB Authoring application: GIMP
MD5: 4b61ee328cf0458936788ab361fe5d8c SHA-1: c34abcb495f1c7d6c1d1441789c876eb757265dd SHA-256: 524d4f09a273ccfd4ac76d9b9addc0ca0a2f6db31dae1d96bcd96b0b7c6df7e8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDF files across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection. The document body itself is heavily obfuscated and contains some of the same URLs, reinforcing the link-based attack pattern.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://garo.imakerlab.club/uploads/2020/01/28/poxogalofawotomeba.pdf
    • http://classidisocializzazione.org/uploads/1/3/0/5/130590233/renesufowemag.pdf
    • http://sr-studenica.org/uploads/1/3/0/4/130490245/6985704.pdf
    • http://daw.secludeddating.com/uploads/2020/01/28/beb7e9a868.pdf
    • http://annaaufseeser.com/uploads/1/3/0/5/130550724/48b9034b90.pdf
    • http://aaasteamandsauna.com/uploads/1/3/0/2/130289542/b2a3c77891ea51.pdf
    • https://nolupunitis.weebly.com/uploads/1/3/0/5/130550859/85334f9ac4.pdf
    • http://electrotech.vip/uploads/1/3/0/5/130546977/3985271.pdf
    • http://luminousoc.com/uploads/1/3/0/6/130603850/dopewakozupito.pdf
    • http://kaban.savich.pro/uploads/2020/01/28/rametek.pdf
    • http://tuzole.dom-gleden.icu/uploads/2020/01/27/lopegerefozeliwux.pdf
    • http://carlsbadmobiledetail.com/uploads/1/3/0/3/130379246/waperov_jonug_natejupaxeju_dupere.pdf
    • http://myrolemodel.info/uploads/1/3/0/5/130590499/nijevawu.pdf
    • http://oaespto.com/uploads/1/3/0/6/130639476/dofewenagevos_soxitewexepafok_redojofewa_kotufo.pdf
    • http://professionaltowingtampa.com/uploads/1/3/0/6/130604724/3000553.pdf
    • https://watajovasix.weebly.com/uploads/1/3/0/5/130551756/sesafuwutibano.pdf
    • http://neverreacttohate.com/uploads/1/3/0/2/130289482/9044730.pdf
    • http://consulatcotedivoire.com/uploads/1/3/0/5/130544318/4676712.pdf
    • http://89cougars30th.com/uploads/1/3/0/5/130588277/8bc55522d65.pdf
    • http://bernardobellostudio.com/uploads/1/3/0/4/130476075/130476075.html#platformio+esp8266+freertos

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015f4.bin
6f11015ce3f518f638022f8377a4c8725e3c0e0a38b5d9e1e0e9ec00e8addbc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15F4 8848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.