Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6355aa691ea69c2…

MALICIOUS

PDF

39.8 KB Authoring application: Serif PagePlus
MD5: 45200451eefa84fc7f3a3f7fa515a623 SHA-1: 9e19db849d296407ec5c6bf5ae58c3966ac8dc67 SHA-256: a6355aa691ea69c2d509b69ddb411a5fcbfc254ff050dd1b9dc53ac3bef6bc28
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs, identified as a link farm. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, with the first URL being http://seanqiao.com/uploads/1/3/0/6/130605001/1374679.pdf. This suggests the document's primary purpose is to redirect users to a large collection of other PDF files, likely for SEO manipulation or to serve as a distribution point for malicious content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seanqiao.com/uploads/1/3/0/6/130605001/1374679.pdf
    • http://uciesl.com/uploads/1/3/0/3/130324136/birezizinezoxijovaj.pdf
    • http://fuerst.si/uploads/1/3/0/5/130589366/nobozij_tugifavotafis_ranafunebapotu_fudexapuxise.pdf
    • http://chicagostpatricksdayparade.com/uploads/1/3/0/5/130588565/rolitegebetat.pdf
    • https://tegalelo.weebly.com/uploads/1/3/0/3/130323914/lisan.pdf
    • https://guwobipis.weebly.com/uploads/1/3/0/4/130483498/93705ad57913.pdf
    • http://cookiesbykae.com/uploads/1/3/0/5/130588810/e10fb8811f011cb.pdf
    • http://monicarayscott.com/uploads/1/3/0/6/130605149/592778.pdf
    • http://contractor-exam.mobi/uploads/1/3/0/6/130639926/8304366.pdf
    • http://patlakescc.net.au/uploads/1/3/0/2/130289453/bf33430a.pdf
    • http://pebatafi.rofrest.ru/uploads/2020/01/28/c50d1291.pdf
    • http://famozeb.leoescamilla.com/uploads/2020/01/28/roxadome_pilirata.pdf
    • http://neighbors4christ.org/uploads/1/3/0/5/130588594/26c83c4eb240709.pdf
    • http://nuvueindustrialsolutions.com/uploads/1/3/0/4/130476539/pifepogugoja_gakezub.pdf
    • http://morenoguerrero.com/uploads/1/3/0/5/130550814/risoniliron-luvone-zijufoj-vezigupi.pdf
    • https://vusuvujevugizon.weebly.com/uploads/1/3/0/2/130288318/3151646.pdf
    • http://theporterauthority.com/uploads/1/3/0/5/130551749/3420660.pdf
    • http://wij.best-shop21.ru/uploads/2020/01/28/borexasabumo.pdf
    • http://brewhousemarketandwine.com/uploads/1/3/0/6/130620574/9708884.pdf
    • http://mfindia.org/uploads/1/3/0/2/130270866/2ab49.pdf
    • https://buzuripem.weebly.com/uploads/1/3/0/5/130588222/kijularedorobiwegobu.pdf
    • http://laketanglewood.net/uploads/1/3/0/5/130589227/dexuz.pdf
    • http://mirasolrehab.net/uploads/1/3/0/2/130272247/6b57fd8938fa81.pdf
    • http://foothillsbiblefellowship.com/uploads/1/3/0/4/130476060/130476060.html#theo+james+bulge
    • https://buzuripem.weebly.com/uploads/1/3/0/5/130588222/kijularedoro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001711.bin
36c3dde37ee96a1db65e4290067c53398a3bbb4c4a3d5248c72aba3547804d94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1711 9140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.