Malicious PDF — malware analysis report

Static analysis result for SHA-256 81f64443a719cdb5…

MALICIOUS

PDF

42.7 KB Authoring application: Poppler-utils
MD5: 70019b59d37edc8559123e6079a53e29 SHA-1: ea8896673ec245b6d0729e814f3f12ba1fab5d95 SHA-256: 81f64443a719cdb5560e613444366c346928cbcf06cc6d1db22260742ebf84b3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded external links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to drive traffic to malicious content. The ClamAV detection further supports its malicious nature. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pumutuwido.weebly.com/uploads/1/3/0/2/130288761/viliwubat.pdf
    • http://vopa.shortcutviralnews.com/uploads/2020/01/28/kiwipideg-jukirofoz.pdf
    • http://laneju.td-detstvo.org/uploads/2020/01/27/sosamumupa_fipiji.pdf
    • http://jug.binancedex-giveaway.com/uploads/2020/01/27/wamuluzusafewug-fitazaxafuduwug.pdf
    • http://dumusufaji.proastrologiu.ru/uploads/2020/01/27/biwaxujizosaxon.pdf
    • http://find-me-2019.com/uploads/2020/01/27/nomosemitaz_famalut_sudukosoken_sezewurabus.pdf
    • http://xete.dream-boxxx.ru/uploads/2020/01/27/b399044acf8d.pdf
    • http://legaxop.kitai-journal.ru/uploads/2020/01/27/jazipedutepusiboku.pdf
    • http://dute.hayatimbirfilm.com/uploads/2020/01/28/gajuredoxu.pdf
    • http://bonita-casa.ru/uploads/2020/01/27/fuzemelu_lefamujumujug_pimivap.pdf
    • http://netix.supershopes.icu/uploads/2020/01/28/zixunumaw.pdf
    • http://tizamubov.infonetacademy.tech/uploads/2020/01/28/jijilenof.pdf
    • http://wubedivuv.c-5527.ru/uploads/2020/01/27/3341251.pdf
    • https://morarafaf.weebly.com/uploads/1/3/0/5/130590224/130590224.html#best+ab+exercises+for+lower+tummy

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013a2.bin
4590ccf155b65fadf4c1cc92f691e9dc4c611ce10e6c7ecbb3aae40856669993		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A2 7860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.