Malicious PDF — malware analysis report

Static analysis result for SHA-256 983e441191b08677…

MALICIOUS

PDF

43.4 KB Authoring application: pdf-parser
MD5: cc43783f3abfecbcf9fd29ddcced142c SHA-1: 8fb374baf1530ac1f33d6643c909c2cbe3e63d6b SHA-256: 983e441191b0867705bacc0d6835921d75e5199b6e10da13797e9d39c7252fde
160 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The PDF contains a large number of external links, many of which point to other PDF files, suggesting a link farm for SEO or traffic redirection. The 'SE_BROWSER_INSTALL_LURE' heuristic indicates the document's content is designed to trick the user into installing a browser extension or update, a common social engineering tactic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing and traffic redirection intent. The primary IOC is the first URL in the link farm, which is likely the initial point of redirection.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ganowozu.vipiski-besplatno29.icu/uploads/2020/01/28/fabosotigowaledox.pdf
    • http://ledo.bimbasket.ru/uploads/2020/01/28/nebul-megopokulopivun-xafogo-pofem.pdf
    • http://northwichgoldandsilver.co.uk/uploads/1/3/0/6/130639091/xikasopuzik_pidufukero_jepijezijedilog.pdf
    • http://neuracing.com/uploads/1/3/0/5/130544110/kojemapeloxud.pdf
    • http://power-up-potential.com/uploads/1/3/0/5/130590482/laxigus.pdf
    • https://dukemidoxidak.weebly.com/uploads/1/3/0/4/130476188/1855968.pdf
    • http://niehusactuary.com/uploads/1/3/0/4/130476557/vujijuj.pdf
    • http://trast-bonus.ru/uploads/2020/01/28/622da5341.pdf
    • http://adamfarouk.weebly.com/uploads/1/3/0/6/130603747/510f44d884d92.pdf
    • http://napervilleroofingrepair.com/uploads/1/3/0/6/130604823/2889833.pdf
    • http://mrdoghk.com/uploads/1/3/0/5/130539247/ruxedusulidile.pdf
    • http://moemoneybeats.com/uploads/1/3/0/5/130539881/wipilimag.pdf
    • http://campkennedy.com/uploads/1/3/0/4/130435637/voliganuvub.pdf
    • http://kbkornhole.com/uploads/1/3/0/6/130640218/b629573d203.pdf
    • https://fikavidipilotu.weebly.com/uploads/1/3/0/2/130287505/jufokivako.pdf
    • http://salado.ru/uploads/2020/01/29/kugasiwifijesu.pdf
    • http://lovemugshop.com/uploads/1/3/0/2/130289154/kevikaxunovig.pdf
    • http://as13.com/uploads/1/3/0/5/130541285/628cbe47.pdf
    • http://gixi.cityglush6.icu/uploads/2020/01/28/vigaromemibimufava.pdf
    • http://nwspecialtylumbermill.com/uploads/1/3/0/4/130435833/4254299.pdf
    • http://afaparents.org/uploads/1/3/0/3/130379509/130379509.html#chrome+sign+builder+guide

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015c0.bin
6981ff13ed73222d07e400ab9ad75dedab01c5f2b9383009d324a9feb83acc15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15C0 8080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.