Malicious PDF — malware analysis report

Static analysis result for SHA-256 542435e9282f5753…

MALICIOUS

PDF

33.6 KB Authoring application: QPDF
MD5: 3b19bea13490a343f09930c68a148d3e SHA-1: c733d5af72519885314a442f1eaf6354cab0782b SHA-256: 542435e9282f5753d188fc565cf48c87472cc0c584949fc94baf8b6766546e7d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The embedded URLs are likely used to redirect users to phishing sites or to distribute further malware. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.strongrootsghana.org/uploads/1/3/0/5/130540211/86e33c433.pdf
    • http://sarahdguerra.com/uploads/1/3/0/2/130289198/697b6d.pdf
    • http://arightcar.com/uploads/1/3/0/4/130435635/7caae0d.pdf
    • http://opheliawest.com/uploads/1/3/0/6/130639746/5327509.pdf
    • http://davidbahl.com/uploads/1/3/0/6/130640229/8842053.pdf
    • http://farmingnola.org/uploads/1/3/0/4/130483953/sosido.pdf
    • http://kellysandau.com/uploads/1/3/0/6/130639117/6e41718fa437cd.pdf
    • http://lifeandlemonsboutique.com/uploads/1/3/0/5/130588937/pomirikisinota.pdf
    • http://omeri.com/uploads/1/3/0/4/130435835/lebiji-sedajadipixaged-jivazaremusuta.pdf
    • http://canyonman.org/uploads/1/3/0/5/130551449/5433332.pdf
    • http://creativekidgardens.com/uploads/1/3/0/2/130272848/646505dd1a9752e.pdf
    • http://sdrvowners.org/uploads/1/3/0/4/130435839/130435839.html#cara+membuat+title+di+adobe+premiere+pro+cc+2019

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c34.bin
a7b0058c4aad9ec2bd4727d641c00c73baa906aa6de4f41f5226e90c764615fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C34 8004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.