Malicious PDF — malware analysis report

Static analysis result for SHA-256 c52dadf91eb78eb4…

MALICIOUS

PDF

36.6 KB Authoring application: Poppler-utils
MD5: 90c5e2ca37b3e39489385ccba75005c3 SHA-1: d1125ea89215ca3f933928bc080f9c1b8c514a7f SHA-256: c52dadf91eb78eb4df2cdeef972771db04b988d4c73032baafaa903cdd5aaa60
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The primary attack pattern involves directing users to these external resources, potentially for phishing or malware delivery.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kunakekokix.weebly.com/uploads/1/3/0/6/130604779/0cf13f0ff79.pdf
    • http://pinkgorillaejuice.com/uploads/1/3/0/3/130313557/dutovategufalu.pdf
    • http://tolandvideo.com/uploads/1/3/0/2/130272081/4917840.pdf
    • http://thisweeksbestdeals.com/uploads/1/3/0/4/130483396/zimugejodakipoxusisa.pdf
    • http://chrfiresystem.com/uploads/1/3/0/6/130604525/fidatozijuwuwux.pdf
    • http://kofc11415.org/uploads/1/3/0/4/130435685/lasuxo_sijituvutoxisu_nuxegowefajid.pdf
    • http://justbcosmetics.com/uploads/1/3/0/2/130289279/loxowirozesok-vujusaneseb-nasuberesaloko-mixowo.pdf
    • http://saje.storefb.xyz/uploads/2020/01/27/95652c7eb1bc.pdf
    • https://levikujakezodu.weebly.com/uploads/1/3/0/4/130476821/nigipozinofu.pdf
    • http://nprycetest.com/uploads/1/3/0/4/130483114/kivufakifutekuvu.pdf
    • http://kito.sisinfdoctum.tech/uploads/2020/01/27/timomosogofagu.pdf
    • http://worksofvalerychalidze.com/uploads/1/3/0/2/130289233/f2cd530773a.pdf
    • http://ametkorca.com/uploads/1/3/0/4/130488141/padinolepigede-lilapezinikud-riluva.pdf
    • http://magnusandsons.com/uploads/1/3/0/6/130605077/8b0d5c3ef.pdf
    • http://kamconsulting.fr/uploads/1/3/0/5/130590368/8420450.pdf
    • http://mrallenscience.com/uploads/1/3/0/6/130622091/xepobi_rekoji.pdf
    • http://cageymoon.com/uploads/1/3/0/6/130605255/repijenemujeluv.pdf
    • http://opentesol.weebly.com/uploads/1/3/0/2/130289375/4321216.pdf
    • http://sallycasey.com/uploads/1/3/0/6/130640061/79cc1.pdf
    • http://yeahviva.net/uploads/1/3/0/4/130489331/9911423.pdf
    • http://noordzeebanket.com/uploads/1/3/0/3/130324419/130324419.html#converting+decimals+to+fractions+worksheet+4th+grade

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017ce.bin
b5f4aca7fe02354ebf941e4611e6287293c9f9d131dd0b2eccfdbc16046eb1c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17CE 7944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.