Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8c28a821bc9f19a…

MALICIOUS

PDF

62.2 KB Authoring application: Poppler-utils
MD5: 5c6222b56626790f08624f6219def9a1 SHA-1: 2ed1bafdb27d5e3525e3308bb6eea035dea520e4 SHA-256: f8c28a821bc9f19a7303faf57a2c5edc2f2d94cbeeed9e3136648b5964fe2653
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or SEO manipulation tactic, often used to distribute malicious content or to artificially inflate search engine rankings. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a malicious intent, likely related to phishing or traffic redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sherburnetrails.org/uploads/1/3/0/6/130621997/kififenifipipexusav.pdf
    • http://myangelsandcherubs.com/uploads/1/3/0/4/130483756/maxuzitasate-zopodamuru-jufep.pdf
    • http://a-aon.com/uploads/1/3/0/4/130488578/nekasajuw-lifuludoden-negitodenewolik.pdf
    • http://svreunion.com/uploads/1/3/0/2/130271076/fananomefofo.pdf
    • http://ntxsportswear.com/uploads/1/3/0/4/130436258/jipaj.pdf
    • http://gujelolo.ra-maep.ru/uploads/2020/01/29/webokikumi.pdf
    • http://cisna.org/uploads/1/3/0/6/130621467/5212788.pdf
    • http://life9rescue.org/uploads/1/3/0/4/130477201/578906.pdf
    • http://dakuko.veksvetodiodov.ru/uploads/2020/01/29/4579082.pdf
    • http://exale.pw/uploads/2020/01/29/kopozodazega_misixus_xazojozidubu_guwotib.pdf
    • https://gabedesugilisop.weebly.com/uploads/1/3/0/5/130551140/73aa9.pdf
    • http://nicolasvaradi.com/uploads/1/3/0/4/130435844/130435844.html#acier+corten+fiche+technique+pdf

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000165e.bin
d362697c7318954b891a17f6eeba978d1c7b12cdd19780c157bde029728d34c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x165E 11980 bytes
font_01_sfnt_off0000a416.bin
b4eaba1313c2ae02e0840532e8df49817f4492e706e7fc7006fa435ca033da2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA416 16208 bytes
font_02_sfnt_off0000b8f1.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB8F1 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.