Malicious PDF — malware analysis report

Static analysis result for SHA-256 c51edcc97afce162…

MALICIOUS

PDF

31.6 KB Authoring application: Soda PDF
MD5: ffa1a4ef99c4bb31eacc3818dc0154b2 SHA-1: c9be0d2d06363e7c27ca88d23836253b4ebff203 SHA-256: c51edcc97afce1625ea47435751523330a310f6a55922a16e1ce78afe4afa5ed
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded external links, identified as a link farm. The document body, though heavily obfuscated, contains references to a song and directs the user to click a link. This behavior, combined with the ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall', strongly suggests a phishing or malicious redirection attempt. The primary goal appears to be directing users to malicious PDF files hosted on various domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://consultoresasociados.org/uploads/1/3/0/2/130274319/c0f4051cf.pdf
    • http://venenodeescorpion.com/uploads/1/3/0/6/130604109/jitovonugokud.pdf
    • http://flourishhealthmd.com/uploads/1/3/0/3/130323471/3485282.pdf
    • http://potterysocial.com/uploads/1/3/0/4/130476168/zudejuxejone-jigolaxub-fosisesadu.pdf
    • http://rochesterlistens.com/uploads/1/3/0/5/130541574/2a34c2bdde7adf.pdf
    • http://rbaltazar.com/uploads/1/3/0/6/130621384/noginigubapanap_navixu_dawinemaluzides.pdf
    • http://xixapu.goods-trends.top/uploads/2020/01/28/9206886.pdf
    • http://ajautosalesva.com/uploads/1/3/0/3/130379226/70f6c4654e303.pdf
    • http://brendascircle.pink/uploads/1/3/0/6/130604129/gafevaxevuna.pdf
    • http://mytorchdata.com/uploads/1/3/0/5/130543320/24856d.pdf
    • http://weekeepcompany.com/uploads/1/3/0/5/130589114/bapasetuzujogi_fodananap_kajenuwu.pdf
    • http://scoanet.weebly.com/uploads/1/3/0/3/130313491/95190.pdf
    • http://willowwolffurnishings.com/uploads/1/3/0/6/130621794/3563520.pdf
    • http://lisaspinelli.com/uploads/1/3/0/6/130605374/pesezasunetatuf_xapapi_gudukuloxexif_pevisez.pdf
    • http://nuobeijinghotel-chinese.devsite-1.com/uploads/1/3/0/6/130639222/130639222.html#ijazat+falak+shabir+video+song

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013f3.bin
fa818d59bdab5dc4990d32c64535943a4257947d351f1edaabf9d92b39841dbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F3 7996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.