Malicious PDF — malware analysis report

Static analysis result for SHA-256 c353acf59752cd2a…

MALICIOUS

PDF

35.8 KB Authoring application: Pdftk
MD5: ff4e40d6cb1e602b20bdd6b38726702f SHA-1: 788abbedcc817dd50e54cdbb90b0ee0fe34195b4 SHA-256: c353acf59752cd2ab7b278b1d911e9aec5a23377da1a56d13347cd9d59609d31
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a common technique for SEO poisoning and phishing. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing intent. The document body, despite being heavily obfuscated, contains references to 'budget vs actual excel spreadsheet' and numerous URLs, indicating a lure to download further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pufudelo.vipiski-besplatno28.icu/uploads/2020/01/28/4b46881e8.pdf
    • http://sflat.net/uploads/1/3/0/2/130271154/getoxe.pdf
    • http://networkhearing.net/uploads/1/3/0/5/130539315/7506743.pdf
    • http://aleonor1to1.com/uploads/1/3/0/5/130539679/2788177.pdf
    • http://newlifewatersolutions.com/uploads/1/3/0/5/130588762/nazanopogevezibogi.pdf
    • http://hitcharchive.com/uploads/1/3/0/7/130739180/7372052.pdf
    • http://michaelkeithwelch.com/uploads/1/3/0/6/130604335/2451303.pdf
    • http://bgflowermart.com/uploads/1/3/0/5/130550885/4907976.pdf
    • http://yposf.com/uploads/1/3/0/4/130489343/df7d3.pdf
    • http://alejandrodu.com/uploads/1/3/0/4/130489172/130489172.html#budget+vs+actual+excel+spreadsheet

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011a7.bin
422df1b4370da3fb805ce9d38f6e62259d0a788592a1d66429acd973643b3d80		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A7 8236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.