Malicious PDF — malware analysis report

Static analysis result for SHA-256 a31c48b04c4b107d…

MALICIOUS

PDF

37.3 KB Authoring application: Adobe PDF Library 9.0
MD5: 6a2d22afd12350c8ad40857a69455f12 SHA-1: 4c0f33f405d741f8f9395ac1eb8ecdeba904b00e SHA-256: a31c48b04c4b107d9726be856377b92800081035f8592188af89c47e2f23d10a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection indicates this is a known phishing variant. The embedded URLs are likely used to redirect users to malicious sites or to manipulate search engine rankings. The primary malicious URL identified is http://muraje.vodabao1.ru/uploads/2020/01/28/a71c4fea.pdf.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muraje.vodabur1.ru/uploads/2020/01/28/a71c4fea.pdf
    • https://pusuzifavawazu.weebly.com/uploads/1/3/0/6/130604363/2fc8492a7.pdf
    • https://zujepibak.weebly.com/uploads/1/3/0/5/130543020/disesujej-muwaxot-xuregidube.pdf
    • http://atladdictions.com/uploads/1/3/0/2/130271159/8293146.pdf
    • http://lowstory.ru/uploads/2020/01/28/8640618e23f08.pdf
    • http://xokugumoli.good-power.ru/uploads/2020/01/29/sepibob_lapote_nomakiwiworefen.pdf
    • http://levelupmastermindgroup.com/uploads/1/3/0/4/130483136/871e7387d3b.pdf
    • http://kennebunkportbedandbreakfast.com/uploads/1/3/0/6/130620887/914611.pdf
    • http://razbaby.ru/uploads/2020/01/29/621b5e28c.pdf
    • http://skinbeautybymaggie.com/uploads/1/3/0/6/130620509/nozitasaxaf-kudebikeb-wapikimavaged.pdf
    • http://offalyit.com/uploads/1/3/0/6/130621228/mupux-mudanatur.pdf
    • https://digasero.weebly.com/uploads/1/3/0/3/130312923/1455961.pdf
    • http://zujari.hoex.ru/uploads/2020/01/27/606b8828aac14.pdf
    • http://navafus.ants-life.ru/uploads/2020/01/27/3669948.pdf
    • http://pelurafuru.rus-snow.ru/uploads/2020/01/28/bexikofaravajid-natewexabog.pdf
    • http://pozawit.suzr.info/uploads/2020/01/29/af94f74.pdf
    • http://jasonrgenua.ca/uploads/1/3/0/6/130620626/rujivefo_lukunatomunanu.pdf
    • http://maternity-depot.net/uploads/1/3/0/6/130621153/vopimiporosofaz.pdf
    • http://watar-ksa.com/uploads/1/3/0/6/130604446/130604446.html#fra%C3%A7%C3%A3o+propria+impropria+e+aparente

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000161c.bin
4a17f13401ded9b8404936d03173ecafb4fe0b19615dcb60c9a1a2c5907657c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x161C 10700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.