Malicious PDF — malware analysis report

Static analysis result for SHA-256 9afcb42d676ee3d2…

MALICIOUS

PDF

46.8 KB Authoring application: Soda PDF
MD5: 3beee9969785f5bf78300648f7895c28 SHA-1: 04b21a1ee5c7a8dad8354cb024694934b7b0258e SHA-256: 9afcb42d676ee3d2f4ca32b2d88927f328d186b3b6ca927c92d546c81b36ddf8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded URLs, indicating a link farm designed to redirect users. The primary heuristic firing, PDF_SEO_LINK_FARM, confirms the presence of numerous external PDF links, with the first identified URL being http://tiadasempanadas.com/uploads/2020/01/29/9618464.pdf. This suggests a phishing or malware distribution attempt.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tiadasempanadas.com/uploads/2020/01/29/9618464.pdf
    • http://procemeterymanagement.com/uploads/1/3/0/4/130435905/xagatu-dutoz-nitomomoru.pdf
    • http://wusixu.kqroup.ru/uploads/2020/01/27/zevaxoz.pdf
    • https://witoxovi.weebly.com/uploads/1/3/0/3/130379371/jaloxot.pdf
    • http://scripttoscreenplay.com/uploads/1/3/0/2/130287920/ferodutati-gosolovemug.pdf
    • http://bajejavuna.gamebuy.online/uploads/2020/01/28/3d717.pdf
    • http://advancedfire.net/uploads/1/3/0/5/130545882/3f58e.pdf
    • http://neku.project-inspire.global/uploads/2020/01/29/1f59f913724.pdf
    • http://vidracariaartvidros.site/uploads/2020/01/27/a2a135.pdf
    • http://utile-it.com/uploads/1/3/0/6/130604249/28698.pdf
    • http://alliedmedstaffing.com/uploads/1/3/0/4/130489082/7975400.pdf
    • http://alstart.co.uk/uploads/1/3/0/5/130545365/wadupemogorovibolef.pdf
    • https://jefajoso.weebly.com/uploads/1/3/0/5/130546803/25f6bed1f8d5f.pdf
    • http://zuxotilizi.freedomflow.ru/uploads/2020/01/29/rodovipo.pdf
    • http://newhopeakron.com/uploads/1/3/0/2/130272557/biwumix_kenogujegi.pdf
    • http://brentoliveracademicprofile.com/uploads/1/3/0/4/130476496/kunesuvidamigap_wexawil_jukonu.pdf
    • http://mandalayoptique.com/uploads/1/3/0/2/130288498/xelabuzoz.pdf
    • http://goodsinside.ru/uploads/2020/01/28/subiwezune.pdf
    • http://xekupome.wise-design.ru/uploads/2020/01/28/da92641265f324.pdf
    • http://kijomuj.lierac-paris.ru/uploads/2020/01/28/4074883.pdf
    • http://backuphard.weebly.com/uploads/1/3/0/3/130323817/090068e886960c2.pdf
    • https://radoxavete.weebly.com/uploads/1/3/0/4/130483519/4022455.pdf
    • http://cuppagusto.com/uploads/1/3/0/6/130605376/laguxunavidu.pdf
    • http://koxosawe.mnekak.pro/uploads/2020/01/27/kosoxoregorex.pdf
    • http://annalyzethat.com/uploads/1/3/0/3/130379096/vejiw.pdf
    • http://pharmacyload471.weebly.com/uploads/1/3/0/2/130271073/130271073.html#traffic+report+junction+21+m1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001347.bin
7d30f005e7c68ac4f2e7adfdc0128bfba44309bd658cb29b917eda46bfd43860		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1347 8260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.