Malicious PDF — malware analysis report

Static analysis result for SHA-256 82fbf8e84f7072fd…

MALICIOUS

PDF

54.5 KB Authoring application: pstoedit
MD5: 4e39a53b5222ec3c231af2a56c265fcc SHA-1: 706ccaedb809da0830411df975c921ea599e7316 SHA-256: 82fbf8e84f7072fde2599f1b887cf09d9a54003c8b32081e4f4e62ce1163de3d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded external links, indicative of a link farm designed to redirect users to potentially malicious content. The document body contains garbled text and some URLs, further supporting the phishing or malware distribution intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ben.eliadore.com/uploads/2020/01/27/7110424.pdf
    • http://lilmissrealtor.com/uploads/1/3/0/4/130436367/4153024.pdf
    • http://learningstem.info/uploads/1/3/0/4/130476313/bozagizuze-wezadetixovid-lowakejas-vanelabir.pdf
    • http://semamewo.walkwork.info/uploads/2020/01/28/6631893.pdf
    • http://sodewu.tehnika-ask.ru/uploads/2020/01/27/jaxuga.pdf
    • http://africanretreats.com/uploads/1/3/0/6/130605115/jinugi.pdf
    • http://myoregonterritory.com/uploads/1/3/0/4/130435819/gogira.pdf
    • http://theapostolicchurch-newlife.org/uploads/1/3/0/2/130271214/zenavidawojugerek.pdf
    • http://mermaidfitnessbump.com/uploads/1/3/0/4/130477028/510ff9d7149efbe.pdf
    • http://coolboymusic.us/uploads/1/3/0/6/130639105/pofaxeretununo.pdf
    • http://porotewo.mumi-dol.ru/uploads/2020/01/27/2640039.pdf
    • http://quartzvanitydirect.com/uploads/1/3/0/6/130621839/wibigewolar_mifijorufuganep.pdf
    • http://syrettdesigns.com/uploads/1/3/0/2/130272247/d3291f165b9287f.pdf
    • http://rollnrock.com/uploads/1/3/0/5/130590373/51cb0b53690c37f.pdf
    • http://nhca-lions.org/uploads/1/3/0/5/130590577/61c91.pdf
    • http://dipetusene.as-ru.ru/uploads/2020/01/27/ffb7c159f6e.pdf
    • http://nija.trouversfr.info/uploads/2020/01/27/morabojuzupufunibob.pdf
    • http://businessandhome.weebly.com/uploads/1/3/0/2/130288520/kopoveroge-xojuzimomagisa-bavobipufibow-bofebor.pdf
    • http://riversidecountyhistory.org/uploads/1/3/0/6/130639136/130639136.html#which+physical+law+underlies+the+first+law+of+thermodynamics+mastering+physics

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000169a.bin
146e6917f87d7dcd4f18e0b2f79af31ce8b9f33ed670c7f7c27624171b2e9f6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x169A 10268 bytes
font_01_sfnt_off00008c3b.bin
f073504f0eec2f6c17bd1b2b0fb5482d4587dafa339116302abf388ce0677ea7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C3B 17092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.