Malicious PDF — malware analysis report

Static analysis result for SHA-256 f41379f9bd3c0698…

MALICIOUS

PDF

45.5 KB Authoring application: QPDF
MD5: 5b6218dd42dc1242013e24046c5b5089 SHA-1: f51aab7c1e15052ca94218bd7b5ae13364a257ca SHA-256: f41379f9bd3c069834238e5bd477671ca2b0f92ada030e565908baab5f1ea32c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged for containing a large number of external links, a common technique for phishing and malware distribution. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature. The embedded URLs are likely part of a link farm designed to redirect users to malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://traceyrossi-portfolio.com/uploads/1/3/0/5/130588475/jabom-rumipixuwiru.pdf
    • http://weluckyfew.com/uploads/1/3/0/2/130273573/bivosuneniwosose.pdf
    • http://lioele.ru/uploads/2020/01/27/622f9802e6a.pdf
    • http://nataliekasdan.com/uploads/1/3/0/6/130621075/bonukisepolanelo.pdf
    • http://pedersenmedicine.com/uploads/1/3/0/5/130588244/b51c0ef002.pdf
    • http://2020blue.org/uploads/1/3/0/4/130436390/130436390.html#bts+variety+show+eng+sub

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001096.bin
a8f0be51a0b2283f02f122ac88f65a7236e73b0d59d17c417ffc8a578993988b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1096 8552 bytes
font_01_sfnt_off00005be6.bin
753f944a000e4fac9e76211e1186bf9d77ee41282b92911bf3bb8b9175335976		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BE6 4772 bytes
font_02_sfnt_off00006aa1.bin
0c05fd20b4b4c335c8c9bffc8308821b43fb8b2bc9dc6e60faaf3ecabcc54214		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6AA1 16300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.