Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e05aeccef2c3ae5…

MALICIOUS

PDF

32.9 KB Authoring application: PDFBox
MD5: 917d92ec4f7a51113cea29068b04bf63 SHA-1: ec4a1262aa4b487591ea583ff80afc153e524043 SHA-256: 9e05aeccef2c3ae58848833be4b06aeaa8f6d58169b52bcd180200f25b298c96
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection also flags this as a phishing attempt. The document body, though heavily obfuscated, contains many of these URLs, suggesting the primary purpose is to redirect users to malicious content hosted on these domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://limpiomallorca.com/uploads/2020/01/27/kakafozetid_wosavubelu_fofevofisunaja_wukaj.pdf
    • http://tegun.vipiski-besplatno64.icu/uploads/2020/01/28/kadoju-degeboluvutonup-mosazari.pdf
    • http://mydevice-apple.com/uploads/2020/01/28/koxuzodivalatakuri.pdf
    • http://pukesagux.scinote.ru/uploads/2020/01/28/soxobijegobewuwem.pdf
    • http://rapegizu.heavenlynaturalhh.org/uploads/2020/01/28/tusure-motuxefezob.pdf
    • http://fosijo.opros-russia.online/uploads/2020/01/28/sitamexobepatu.pdf
    • http://kapajefoz.rusfermer.info/uploads/2020/01/28/wawetadubomurupoxawe.pdf
    • http://guj.aeronika.com/uploads/2020/01/28/faa2f15390a.pdf
    • http://fur.info-okna.ru/uploads/2020/01/27/7320356.pdf
    • https://bepaxibomadof.weebly.com/uploads/1/3/0/4/130490928/3207116.pdf
    • http://roserinake.m6spotify.com/uploads/2020/01/27/6e38fff.pdf
    • https://zawudevo.weebly.com/uploads/1/3/0/5/130541904/130541904.html#adjectival+phrase+vs+clause

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012b4.bin
4dabfbaaa94e51c98a5d39e751c262a57f28352ce76406fb2a69fcb88a3d20d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B4 7772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.