Malicious PDF — malware analysis report

Static analysis result for SHA-256 b002381dbf376f32…

MALICIOUS

PDF

37.7 KB Authoring application: Adobe PDF Library 9.0
MD5: 46b9db0dc6de3f50cad505d0c3414f08 SHA-1: 68a903932598382fa889c7029c9d2e4039f35703 SHA-256: b002381dbf376f321fc0cefa4f2581e1aff94b846aa7758f757353ade331eda3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure document disguised as a "Joint last will and testament template" and embeds a large number of external links. The heuristic PDF_SEO_LINK_FARM indicates a link farm designed to drive traffic to other PDF files, and ClamAV detected it as Pdf.Phishing.TtraffRobotInstall. The embedded URLs are likely used to distribute further malicious content or phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wogal.rostelekomu.fun/uploads/2020/01/28/fusuzetomek.pdf
    • http://lazytrainers.com/uploads/1/3/0/6/130621324/7663364.pdf
    • https://lokuxumuvado.weebly.com/uploads/1/3/0/2/130288924/tunoputoxi.pdf
    • http://judgeammendola.com/uploads/1/3/0/5/130551839/75669.pdf
    • http://rol.alkovozim.com/uploads/2020/01/27/xamekimonovaza.pdf
    • http://lososepom.kaz24.com/uploads/2020/01/29/mevazoxoxe.pdf
    • http://lapatentlawyer.com/uploads/1/3/0/4/130475965/5d12efb70d.pdf
    • http://folotogegu.tiadasempanadas.com/uploads/2020/01/27/guzupefomot-kaninubobu-xelok.pdf
    • http://nife.lada-detail.net/uploads/2020/01/29/talow.pdf
    • http://reeportt.online/uploads/2020/01/27/memakuwuto.pdf
    • https://zebevasibuwetu.weebly.com/uploads/1/3/0/4/130488979/lutot_jarikot_bijuxegobu.pdf
    • http://naturebringsmepancackes.com/uploads/1/3/0/3/130323896/130323896.html#joint+last+will+and+testament+template

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001292.bin
66d61c6f7a5900a257887256cd01eeec9b502277fc8e7d5dd5afb107ed81d51c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1292 7988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.