Malicious PDF — malware analysis report

Static analysis result for SHA-256 588741fe555d3084…

MALICIOUS

PDF

107.6 KB Authoring application: ImageMagick
MD5: 59538852575b5e796430f39ff4cf795a SHA-1: c8d8a2691de97145b57e9f10c24199d1868cc2a0 SHA-256: 588741fe555d308442087d3e7e763eaed7650a127fa5a034cc92c43e8e08a3e7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a link farm or redirection mechanism. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely phishing or malware distribution. The primary IOC is the first URL in the link farm, http://freedomflow.ru/uploads/2020/01/28/mexapikek_niwamajud_laramedoposej.pdf, which is likely part of the malicious infrastructure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://freedomflow.ru/uploads/2020/01/28/mexapikek_niwamajud_laramedoposej.pdf
    • https://lodafudibo.weebly.com/uploads/1/3/0/5/130543787/8c786.pdf
    • http://scbretreathouse.com/uploads/1/3/0/3/130323148/xoturi.pdf
    • http://los.remsokna.ru/uploads/2020/01/28/8722163.pdf
    • http://naillogicinstitute.com/uploads/1/3/0/2/130289669/6837226.pdf
    • http://uwhqsc.org/uploads/1/3/0/2/130291555/vefikinuwulawarifeg.pdf
    • http://wak.centermetod.ru/uploads/2020/01/27/8390321.pdf
    • http://basicbibleguide.com/uploads/1/3/0/6/130639860/5840986.pdf
    • http://krownandglory.com/uploads/1/3/0/5/130588318/93099e593c5418e.pdf
    • http://faguzu.blamecharlie.com/uploads/2020/01/27/5961427.pdf
    • http://gupig.copyrightcontact-1000029438567.com/uploads/2020/01/29/dirokuwunurizaz.pdf
    • https://ruxixuzurigixup.weebly.com/uploads/1/3/0/2/130291358/9290691.pdf
    • http://copyrightcontact-10000671253681.com/uploads/2020/01/28/3880348.pdf
    • http://bodolandnews.com/uploads/1/3/0/3/130313102/sujibobuzaloti.pdf
    • http://zom.uptripper.com/uploads/2020/01/27/pomunij.pdf
    • http://mindforyou.org/uploads/1/3/0/5/130540146/130540146.html#bulacan+state+university+form

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015cd.bin
bc3343ee957b00b67923da74b0eaf8b2ea28e6a72ea70710b0ddc493923af104		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15CD 10280 bytes
font_01_sfnt_off000159ba.bin
98958365168029d4f54c753cd9186d92cfe6c3bbbc0f7ce7585e6a5e6ab2bca4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x159BA 16040 bytes
font_02_sfnt_off00016de6.bin
2c32c498f23db3cae400dac070c72b38d41a5d5dbe5041cbe08e7cee44e1acfd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16DE6 2648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.