Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba802ad36258d97d…

MALICIOUS

PDF

45.7 KB Authoring application: ImageMagick
MD5: 21a5da7531b14d199401b17ba82e21aa SHA-1: 18951fd5c31772f7d2aae6b8e5689f63124a2b4e SHA-256: ba802ad36258d97daafce8f06f11367d95dc33610d57520e5f1bc6871efb0dcb
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files, indicating a link farm designed to drive traffic or distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the 'SE_INVOICE_LURE' heuristic further support a phishing or malware distribution intent. The document body, though heavily corrupted, contains references to 'expense report' and 'Concur', suggesting a lure related to financial or business transactions.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://madeformorecreations.com/uploads/1/3/0/6/130604322/padaxobofasi.pdf
    • http://lpcares.com/uploads/1/3/0/6/130605498/bosadozetowamuxevufu.pdf
    • http://therebuildcovenant.org/uploads/1/3/0/2/130272524/busola-lusira-digivofa.pdf
    • http://xamuvopi.uykraken.com/uploads/2020/01/27/libatukixad.pdf
    • http://rycl.weebly.com/uploads/1/3/0/6/130605229/zupokatiwo-radosod.pdf
    • http://rcbinns.com/uploads/1/3/0/2/130289774/9725584.pdf
    • http://zof.coffee-remont.ru/uploads/2020/01/29/ba53a6.pdf
    • http://wusasu.lechenienarkomanii-ivanovo.ru/uploads/2020/01/28/b39c55b0dbdcb9.pdf
    • http://regenerateyourauthenticnature.com/uploads/1/3/0/4/130476053/9759644.pdf
    • http://momentumva.com/uploads/1/3/0/6/130620317/7258590.pdf
    • http://avispire.co.uk/uploads/1/3/0/5/130589444/a4ef37efe.pdf
    • http://wawogaber.texdom64.ru/uploads/2020/01/27/e5bbcf6.pdf
    • http://dearbornpainterpros.com/uploads/1/3/0/4/130483863/fifepekawivobixeja.pdf
    • http://monicasfantasticcakes.com/uploads/1/3/0/5/130588452/9bc91c3a4839c6f.pdf
    • http://americanaboriginenationsunited.org/uploads/1/3/0/2/130289172/vazomelewasikew_xolipejipo.pdf
    • http://serenavitabirth.com/uploads/1/3/0/5/130551941/xusanobewalelon_roligisedobivi_ribip_komujudevor.pdf
    • http://milweeband.weebly.com/uploads/1/3/0/6/130639488/7668641.pdf
    • http://bcsinmoohapkido.com/uploads/1/3/0/4/130436037/130436037.html#concur+expense+report+cost

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000151d.bin
47209208be50e05aca368060785d426046e51f19861b7abe3ea28365b9b91223		 pdf-font-stream PDF embedded font (sfnt) at offset 0x151D 8132 bytes
font_01_sfnt_off00006e07.bin
6e3a6741810b43ec9b31014a018f21d8bf924aaae4f7d6518b2ef750acd478eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E07 5856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.