Malicious PDF — malware analysis report

Static analysis result for SHA-256 ffcd5b41aa5e2643…

MALICIOUS

PDF

30.9 KB Authoring application: Adobe PDF Library 9.0
MD5: 7cec5588ba5fc8d85784fc4693de88cb SHA-1: 17614d6a042fbaf7740b7c4f1bae048423f5e22a SHA-256: ffcd5b41aa5e2643ed834cca3081aeb6c77cb048d67c207997cbea09c28b938d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which are designed to redirect users to various malicious sites. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the phishing nature of this document. The document body, though heavily obfuscated, contains references to movie downloads, indicating a lure to entice users to click the malicious links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ivjournal.com/uploads/1/3/0/7/130738823/sutogegek-parafajole-nigiwebe-vivujunuju.pdf
    • http://meliciosa.com/uploads/1/3/0/2/130271229/3487094.pdf
    • http://chule.es/uploads/1/3/0/5/130590564/cf39ab59174b98.pdf
    • http://drandrewwalker.com/uploads/1/3/0/5/130539810/1010072.pdf
    • http://chloecustomcollections.com/uploads/1/3/0/5/130547846/5eecdb39d4c.pdf
    • http://fisa.lulacrib.com/uploads/2020/01/28/fugebixova.pdf
    • http://meshayla.com/uploads/1/3/0/5/130550697/130550697.html#raja+chhattisgarhi+movie+free

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001098.bin
2ec5ec3ade7931115ccbfa983e9cf2a4605ddce0ba147955e4f0f6c756689435		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1098 7284 bytes
font_01_sfnt_off00003cf2.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CF2 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.