Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb62af3004940fe2…

MALICIOUS

PDF

49.7 KB Authoring application: Serif PagePlus
MD5: 3a1131d8384487fce2e6f619b8d0a6e1 SHA-1: c919e306be7c5265f65ad359a55ab5df98d28eba SHA-256: fb62af3004940fe2242fb5ced143af6edc66dcb0778f3a58591afb9789a53a9f
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files, indicative of a link farm. The presence of a 'download' lure and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' strongly suggests a phishing or malicious download campaign. The document body, though heavily corrupted, contains references to downloading a movie, which is likely a pretext to disguise the malicious intent of the embedded links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://taurum.ch/uploads/1/3/0/6/130639133/zutakewewixide.pdf
    • http://meridian-dcg.com/uploads/1/3/0/5/130590654/2626ff04bc4c8d.pdf
    • http://mysterclothingbrand.com/uploads/1/3/0/2/130273798/4958701.pdf
    • http://audioriotmusic.com/uploads/1/3/0/5/130547112/106e8198.pdf
    • https://bikisebojumovov.weebly.com/uploads/1/3/0/3/130323475/5121763.pdf
    • http://mmfadocents.weebly.com/uploads/1/3/0/5/130589032/vofudara.pdf
    • http://nesteam.co.il/uploads/1/3/0/6/130622066/8880560.pdf
    • http://meroveo-officedistribution.store/uploads/1/3/0/5/130590462/8746668.pdf
    • http://bernardobellostudio.com/uploads/1/3/0/6/130639129/7b57e.pdf
    • http://chule.es/uploads/1/3/0/5/130590545/mojamutisagi.pdf
    • http://wito.itechieguru.com/uploads/2020/01/28/begoj.pdf
    • http://alvahenriksson.com/uploads/1/3/0/4/130490977/ninatubek.pdf
    • http://barbaramars.com/uploads/1/3/0/6/130620848/gokiritedo.pdf
    • http://callowayumc.org/uploads/1/3/0/6/130621781/8271564.pdf
    • http://tauroafarmandwildexperience.com/uploads/1/3/0/2/130271061/gofaliwafabovogededu.pdf
    • http://olaarte.com/uploads/1/3/0/2/130271063/2493869.pdf
    • http://angelschic.com/uploads/1/3/0/2/130273578/werukuviz.pdf
    • http://tcsonline.net/uploads/1/3/0/6/130604602/130604602.html#bluffmaster+2005+full+movie+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001518.bin
28e22c4cd89e758503f1d3fac82b113ecb4c562b8387e7732982483b2249202c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1518 10032 bytes
font_01_sfnt_off00007b7a.bin
32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B7A 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.