Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5bf92e7a9058ab6…

MALICIOUS

PDF

43.3 KB Authoring application: PDF Studio
MD5: 3f40823fa7549028d6b0cafe02de3420 SHA-1: 527f99ff0d0f7ec1fb11c62a90132164ea017989 SHA-256: a5bf92e7a9058ab6e49ea308d46594eb2f3e88199f9f2524209a1966215f3cad
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files on different domains. This is indicative of a link farm used to distribute malicious content or conduct phishing operations. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. The embedded URLs are the primary IOCs for this attack.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://looe-festival-of-the-sea.com/uploads/1/3/0/6/130639648/tujiruguwejefawebuki.pdf
    • http://cadecim.com/uploads/1/3/0/6/130639701/vusebemefetixaw.pdf
    • http://icedome4on4.com/uploads/1/3/0/4/130490078/fepujitaxeva_sivuw_zewukir_xobumekuviviwu.pdf
    • http://castillocoin.com/uploads/1/3/0/7/130776104/tojifotusorexokufewe.pdf
    • http://niredak.vipiski-besplatno34.icu/uploads/2020/01/28/mufasexaze-fafakinunamud.pdf
    • http://moodlabnewlife.nl/uploads/1/3/0/2/130289662/130289662.html#boat+trip+ielts+listening+answer+key

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001124.bin
635b29807e3f47dcf94bcdbc1a4b5dcbd2508dfdf07b9fe6888360db7072f985		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1124 8996 bytes
font_01_sfnt_off00006168.bin
a2e3cbc158b6e09118aeb3935c0d2415fb142a5e6e5e0d1b3e6aa10a7178bc10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6168 16616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.