Malicious PDF — malware analysis report

Static analysis result for SHA-256 c554c143dad4018b…

MALICIOUS

PDF

38.8 KB Authoring application: Serif PagePlus
MD5: 46df4e477c8a685711eb92bef03cb352 SHA-1: ca93695b644e9520b3bc56f8c671705d9b586311 SHA-256: c554c143dad4018b8b1ed62b9d9446052041f915c2a4a4012d4934ce15ee0bbb
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The document body, though partially corrupted, contains references to coroner's inquest reports and includes many of the extracted URLs, suggesting a lure to external content. The primary intent appears to be redirecting users to a link farm, potentially for phishing or malware distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://man.supletivolitoral.com/uploads/2020/01/29/9dadc0e.pdf
    • http://aftersales.nopeus.eu/uploads/1/3/0/5/130550937/xotubunoj-kododerigagu-molaxosededowe-kilekavuxumon.pdf
    • http://miquelroig.com/uploads/1/3/0/3/130323592/lebewuti.pdf
    • http://lonestardbc.org/uploads/1/3/0/5/130588389/koradad.pdf
    • http://backroadcreations.com/uploads/1/3/0/6/130620929/buxidatasunufu.pdf
    • http://nanni.info/uploads/1/3/0/5/130543600/vinawurijutisu.pdf
    • https://marugigubukadef.weebly.com/uploads/1/3/0/5/130551153/7fdb927511e.pdf
    • http://antiviruseprotectserviceonline.site/uploads/1/3/0/4/130476976/130476976.html#coroner%27+s+inquest+reports+uk

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001160.bin
a508b57d1be40cc5aab13afce9614678fc8156a13be356cbf28edbfacdd2ce34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1160 8368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.