Malicious PDF — malware analysis report

Static analysis result for SHA-256 53930378c27f6c92…

MALICIOUS

PDF

40.6 KB Authoring application: QPDF
MD5: 34f5a02bdab1c652d30075793ff60cc4 SHA-1: d061302768b78c122b88ccf3b1adaefee0f7be3c SHA-256: 53930378c27f6c921b015a24acfcd8c028156ff46f697ec36eb704b9bbef1c3a
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The document body, while heavily obfuscated, appears to be a lure related to 'Zimsec o level mathematics past exam papers'. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further indicates a phishing or traffic redirection intent. The primary attack pattern involves directing users to download malicious content via a network of linked domains.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://heinshomeimprovement.com/uploads/1/3/0/6/130604327/gabiwifagipotaziguto.pdf
    • http://reliablelimoja.com/uploads/1/3/0/7/130775413/005cfa9870.pdf
    • http://tolhouse-design.com/uploads/1/3/0/5/130545884/6523316.pdf
    • http://amandawoodshall.com/uploads/1/3/0/4/130475997/xenizakor.pdf
    • http://easytobuyahouse.com/uploads/1/3/0/5/130590469/rutoxevupelifivo.pdf
    • http://libertodos.org/uploads/1/3/0/7/130776500/5502252.pdf
    • http://icleanup.net/uploads/1/3/0/5/130589184/bazejoruk.pdf
    • http://seniors1stfinancial.com/uploads/1/3/0/6/130620327/8638234.pdf
    • http://antiviruseprotectserviceonline.site/uploads/1/3/0/5/130543272/130543272.html#zimsec+o+level+mathematics+past+exam+papers+2017
    • http://tolhouse-design.com/uploads/1/3/0/5/130545884/6523316.p

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b9a.bin
1b3f82cd74c5b6671cc0c0d4a6c7877b74bb57ca469b2a61ef541918e41af838		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B9A 2652 bytes
font_01_sfnt_off000047ee.bin
a5630c9bcee91c25ca812e6d97ca21a124cb5f0f32869ee9ec19531609f5aec1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47EE 8916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.