Malicious PDF — malware analysis report

Static analysis result for SHA-256 96d72925675b0396…

MALICIOUS

PDF

46.5 KB Authoring application: Poppler-utils
MD5: 61f889499c41999efde50d0a5d26f587 SHA-1: 67aaf85415c7406ff3163fa6ac082b3e17d88c7a SHA-256: 96d72925675b0396917176e6100f2cef243f3f5e28b3fd42dc7669ff96ee122d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, a common technique for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing intent. The embedded URLs point to various domains, suggesting a broad distribution effort. No scripts were extracted from this sample, but the structure and heuristics strongly indicate a malicious intent to redirect users to potentially harmful content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://meva.itplanet.agency/uploads/2020/01/29/5516562.pdf
    • http://1stclassmovingcarolinas.com/uploads/1/3/0/5/130589342/kosezipuriwi.pdf
    • http://australiancouncilofhinduclergy.org/uploads/1/3/0/5/130588672/vufubibanuwos-vokisano-safurewo-turerawebajux.pdf
    • http://sewifuga.dimeka.ru/uploads/2020/01/28/kixujotowi_fagoju_mikakipufog_puwezol.pdf
    • http://narrowbandingcoordination.com/uploads/1/3/0/2/130287299/150be42177c6a20.pdf
    • http://99-podarok.site/uploads/1/3/0/5/130589312/wifajane.pdf
    • http://myrabi.com/uploads/1/3/0/5/130588997/b750ed8f4f9.pdf
    • http://nashobavalleyextractco.com/uploads/1/3/0/2/130291531/130291531.html#mapa+mudo+rios+espa%C3%B1a+para+imprimir

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001391.bin
a68277d5425c0af0eccf09c4475801e8177b8d917a247c3d28586bfe5666df38		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1391 8860 bytes
font_01_sfnt_off0000702d.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x702D 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.