Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fc2cd26bf691f24…

MALICIOUS

PDF

50.6 KB Authoring application: QPDF
MD5: 84c14e0b5ad1be1fdee2a8078374d371 SHA-1: 55eb287bd9cc1c21865baa9dbf80cf447d34c21c SHA-256: 9fc2cd26bf691f24986177155037e9ba7c397d6c7e3e79207f51306a841d38df
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a significant number of embedded external links, indicative of a link farm designed to redirect users to potentially harmful content. The primary attack pattern observed is the use of these links to lure victims to malicious sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelirevuj.weebly.com/uploads/1/3/0/5/130588517/xilojiwelifowetinofu.pdf
    • http://riverraisinjazzfestival.org/uploads/1/3/0/5/130539179/4414763.pdf
    • http://khulaoncloud.com/uploads/1/3/0/2/130287502/6800408.pdf
    • http://alumniunitbv.net/uploads/1/3/0/2/130271054/3521372.pdf
    • https://penokone.weebly.com/uploads/1/3/0/5/130551564/jobupug_neregesatariles_kegixim_rireliwigaraso.pdf
    • http://lisaspinelli.com/uploads/1/3/0/4/130476830/masekipik_gurizizume_kimuz_vefosotejuziku.pdf
    • http://baxifuvaje.za-rya.ru/uploads/2020/01/28/piriril-gelavugutuner-waxepopa-nevufewagasipa.pdf
    • http://kparksandrec.com/uploads/1/3/0/6/130620712/9e5f611.pdf
    • http://ricorda-group.ru/uploads/2020/01/27/tuselimo_xawomasezifuso.pdf
    • http://grandhyattnewyork.blog/uploads/1/3/0/2/130273761/24ba9.pdf
    • http://xafabu.lotte-business-centre.ru/uploads/2020/01/28/miginubu.pdf
    • http://zugolep.qnxauto.com/uploads/2020/01/27/1426989.pdf
    • https://xovezafig.weebly.com/uploads/1/3/0/6/130605065/rataletolot.pdf
    • http://kewosumi.trasir.ru/uploads/2020/01/28/fabotadopuve.pdf
    • https://sodikefesexim.weebly.com/uploads/1/3/0/3/130323764/fufewek-wovetiv-lotozizedin-zovotimazatoxu.pdf
    • http://allaboutaustraliancobberdogs.org/uploads/1/3/0/5/130588437/bc8f511f1cfa5.pdf
    • http://vuwotasej.respektmebel.ru/uploads/2020/01/28/dujexa-faluteleguw.pdf
    • https://werazufupuluta.weebly.com/uploads/1/3/0/4/130489800/siwejizozafova-kubaneganigew-tukusokaxuvus.pdf
    • http://detourtowonderland.com/uploads/1/3/0/5/130538945/muxuga-jerexexe.pdf
    • http://vezimew.kuprygin.com/uploads/2020/01/27/pivowokovavuser-walenugatoxet.pdf
    • http://tcsonline.net/uploads/1/3/0/6/130620454/130620454.html#huawei+e5573+specification

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001206.bin
4e08ff1c69ff16feb0e7da7dfc0cc51e432dec667cb0a38e3484fe3c9ae4b76c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1206 8304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.