Malicious PDF — malware analysis report

Static analysis result for SHA-256 c796c88fcf17d733…

MALICIOUS

PDF

32.7 KB Authoring application: Solid Converter PDF
MD5: 941a6c8644db3f2ce700f221c31b2078 SHA-1: 7abfcf09318ca905bfec2f1af6b95ce87118d5bf SHA-256: c796c88fcf17d733636d190444a186a6864b85559e80cdd1f9c05835f05d2e35
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, indicating a link farm or phishing lure. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document is designed to trick the user into believing they need a password for an archive, a common tactic to bypass gateway security. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://authortonjamurphy.com/uploads/1/3/0/2/130273913/maxivazuni.pdf
    • http://kijedu.opopx.icu/uploads/2020/01/29/diloke.pdf
    • http://kevinpendergast.com/uploads/1/3/0/5/130547527/wumur-rikuxeb-ziwatumipufib-lidezozaguvugi.pdf
    • http://deardoc.org/uploads/1/3/0/2/130274376/03c50bb739.pdf
    • http://top-shop21.ru/uploads/2020/01/27/5ff879ca8a.pdf
    • http://16dr.pw/uploads/2020/01/29/3611720.pdf
    • http://bodyworkbybarb.com/uploads/1/3/0/5/130590482/gegawafusoxu-topizorilobosa-xobopuzepo-safevuva.pdf
    • http://rbaltazar.com/uploads/1/3/0/6/130605254/3409553.pdf
    • http://tivovawuno.storeshop.xyz/uploads/2020/01/27/3524715.pdf
    • http://motticehammond2020.com/uploads/1/3/0/6/130639790/papotesuwavoju-pomupemas-gojelitureliw.pdf
    • http://pikinejum.rucrime.top/uploads/2020/01/28/17ecad8d185aa07.pdf
    • http://finresult.com/uploads/2020/01/29/1831184.pdf
    • http://raw.etalonclinica.ru/uploads/2020/01/28/sepetasi_jatigavor_visagebe_bivamenowerobe.pdf
    • http://xodoxe.ceodentvicalvaro.com/uploads/2020/01/28/774056.pdf
    • http://servicemyaccount.net/uploads/2020/01/29/6324474.pdf
    • http://lynalen.com/uploads/1/3/0/5/130542996/130542996.html#paranoid+black+sabbath+bass+tab

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001458.bin
08618315bf9ef07c0cf478174ef2feadde65c2f8793de233a5eb673111206725		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1458 7976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.