Malicious PDF — malware analysis report

Static analysis result for SHA-256 f01e62852cd06aaf…

MALICIOUS

PDF

43.7 KB Authoring application: Adobe PDF Library 9.0
MD5: 65c00b099e58867ddb9cc1a335ab3d1c SHA-1: 2789f85fde8cc711a4a21cfce0057fffc47c69d1 SHA-256: f01e62852cd06aaf8b3fa068eff64d4e27c00a311694f523e4a7f630cd99cc75
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This pattern is indicative of a link farm designed to manipulate search engine results or to distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://slpwaboard.org/uploads/1/3/0/5/130588658/907a8fb43c8b.pdf
    • http://kigginsco.com/uploads/1/3/0/5/130588875/2228785.pdf
    • http://muwi.tehnews.ru/uploads/2020/01/28/824506.pdf
    • http://clavesparatusalud.com/uploads/1/3/0/5/130541346/loxelugozexolagarun.pdf
    • http://campaignartwork.com/uploads/1/3/0/3/130379193/xuliv-girodixeb-fifuteliva-kavudol.pdf
    • http://btmamusic.com/uploads/1/3/0/3/130379770/pawivuberajagil.pdf
    • http://jej.greecestyle.ru/uploads/2020/01/27/4521228.pdf
    • http://2tranquility.com/uploads/1/3/0/2/130291485/c77a3d76f18.pdf
    • http://campcruz.com/uploads/1/3/0/3/130323212/1f20ebd9cb87.pdf
    • http://dondealmuerzo.com/uploads/1/3/0/2/130289441/rapesenupedanu_wipitaxonopad.pdf
    • http://sinbinnetwork.com/uploads/1/3/0/5/130588839/vopije_sagefutizitore_kipiketewobap.pdf
    • http://heartlandchurchnetwork.org/uploads/1/3/0/5/130589281/rosaveb.pdf
    • http://uclaprisoned.org/uploads/1/3/0/5/130540026/1766572.pdf
    • https://zumamolakerafi.weebly.com/uploads/1/3/0/6/130604162/vizovodopof_nuvat_debob.pdf
    • http://mobotflexi.com/uploads/1/3/0/6/130621206/130621206.html#biriyani+movie+songs

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013f0.bin
61c8bed0d271eaa9adb5cb068a6dcaa05401766449735de6ab9c591a3f1bc043		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F0 8112 bytes
font_01_sfnt_off00006474.bin
c9655644a945a2bc46672e4d4588f8b8f0381e8adfc868cce1c18b57f13076a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6474 9744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.