Malicious PDF — malware analysis report

Static analysis result for SHA-256 596ee346d650d0f2…

MALICIOUS

PDF

36.9 KB Authoring application: Adobe PDF Library 9.0
MD5: 71d05ec524dfbd1b6f2321bf2f5ea7e8 SHA-1: e223b360c4f6e18e66b15617c1d00cc05e575278 SHA-256: 596ee346d650d0f27a09c87b30db184ebfa7bdec90c9451a6d2f0bbe2766d387
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. The embedded URLs are likely used to direct the user to malicious websites for further exploitation.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zoga.chama.site/uploads/2020/01/28/9671657.pdf
    • https://gubanolib.weebly.com/uploads/1/3/0/5/130551378/kazotegux.pdf
    • http://riza.mupoisk.info/uploads/2020/01/27/ralelefalimor.pdf
    • http://adoredaussies.com/uploads/1/3/0/3/130323616/935454.pdf
    • http://nagikotux.flabgu.com/uploads/2020/01/27/surepejo.pdf
    • http://kamazedope.oplata-trikolor.online/uploads/2020/01/28/tajexazola.pdf
    • http://kexeputum.laserstanki.ru/uploads/2020/01/28/zavep.pdf
    • http://kizawix.dateloveers.online/uploads/2020/01/29/9962311.pdf
    • http://cyclebavaria.com/uploads/1/3/0/4/130436197/130436197.html#pascal+emmanuel+adjovi

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001196.bin
21d47dd824bd78e82b9485b5865248d6470a9b40a8873c91d1b4238665e1a374		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1196 8988 bytes
font_01_sfnt_off00004e57.bin
9f9a669d6e45f7aadaa2bbce49224fc38a29941444c025d6ec2973f3a002e29c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E57 4964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.