Malicious PDF — malware analysis report

Static analysis result for SHA-256 9063028445285147…

MALICIOUS

PDF

34.8 KB Authoring application: PDFedit
MD5: ec6160fe3d9bfa1dcf3a5d1d914c5aff SHA-1: 0fa9b60d9bf248c093808641ac55a77979d9873d SHA-256: 90630284452851473adbe39cf4abad8d57556a83323bbf03a7dd1a3687873023
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass of external links to other PDF files, disguised as an admission form. This behavior is indicative of a link farm or phishing campaign designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. The embedded URLs are the primary IOCs, suggesting a redirection to potentially malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://morris-imports.com/uploads/1/3/0/7/130739198/xafemum.pdf
    • http://octoflow.io/uploads/1/3/0/2/130289294/zopefaxewixopumum.pdf
    • http://momentum.dance/uploads/1/3/0/3/130312920/jalevutapom.pdf
    • http://susanpultman.com/uploads/1/3/0/7/130739654/lafig.pdf
    • http://musesinthevineyard.com/uploads/1/3/0/3/130323733/mamezu_jasuzefugon_rezafa.pdf
    • http://knit1chicago.com/uploads/1/3/0/6/130605273/4c3b6d53bb55d.pdf
    • http://grafixcity.com/uploads/1/3/0/7/130739904/6942626.pdf
    • http://bespokely.com/uploads/1/3/0/6/130620700/wofidovixexuw.pdf
    • http://cass-travis-art.com/uploads/1/3/0/6/130604213/9ca6106d8.pdf
    • http://beaute-totale.com/uploads/1/3/0/6/130605146/bupexefixuw.pdf
    • http://amanziqs.co.za/uploads/1/3/0/4/130476611/cd850eb1af3a2.pdf
    • http://sjsconstruct.com/uploads/1/3/0/6/130604723/lawomag.pdf
    • http://espanolvistarealguatemala.devsite-1.com/uploads/1/3/0/8/130814754/130814754.html#jnv+admission+2020+form

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003029.bin
fea70586efabb2b67b789177546b958df696611f4432f81807e10bdb2ed53bcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3029 7936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.