Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd04c17067960f46…

MALICIOUS

PDF

52.7 KB Authoring application: QPDF
MD5: a4c411cb386d9592a6bd83fa7590951b SHA-1: 82d7955e08051a42affb4c5e554b0e41ae273159 SHA-256: fd04c17067960f464361819f046204ebfd4c27821a38ec0679f00b0a4a92f4a7
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of urgency language ('account will be terminated') strongly suggest a phishing or malware distribution attempt. The embedded URLs are the primary indicators of compromise, likely leading to further malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://varebi.liveturn.ru/uploads/2020/01/28/862723.pdf
    • http://fononamagi.diabaz.ru/uploads/2020/01/29/giroxemefabit.pdf
    • https://judapegiwet.weebly.com/uploads/1/3/0/4/130478709/gifasijawapamure.pdf
    • https://pulugifolebiva.weebly.com/uploads/1/3/0/4/130435702/501c6a17fa0c.pdf
    • http://baccy-earwing.info/uploads/2020/01/27/5821994.pdf
    • https://dikusonum.weebly.com/uploads/1/3/0/5/130588320/lebividuwagiwok.pdf
    • https://sodikefesexim.weebly.com/uploads/1/3/0/3/130323764/601967c13f.pdf
    • http://eskyling.com/uploads/2020/01/27/nuvibesusabubo.pdf
    • http://wokubu.globaltoursjourneys.com/uploads/2020/01/28/zisejopoxevogi.pdf
    • http://nzgzbqazyocs.weebly.com/uploads/1/3/0/5/130545001/3572245.pdf
    • https://moroxegurojajip.weebly.com/uploads/1/3/0/2/130289670/7718248.pdf
    • http://beprosafe.net/uploads/1/3/0/3/130324206/4688820.pdf
    • https://melulisonufixur.weebly.com/uploads/1/3/0/2/130271167/tikubisafuj_ralasuzotuwag_vogeb_rejuvazon.pdf
    • http://mkecabinets.com/uploads/1/3/0/6/130604640/zixosej.pdf
    • http://absystemsllcscam.com/uploads/1/3/0/6/130639852/130639852.html#hanson+buck+score+sheet

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013a8.bin
b0797948280d17ef8dc211657d56ca56369590968bbc5424b41f6104cbdc9911		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A8 8464 bytes
font_01_sfnt_off00008788.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8788 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.