Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bc70985e7a7562e…

MALICIOUS

PDF

39.0 KB Authoring application: SWFTools
MD5: 4099ea903e6b37de2cb9c6c5be67310d SHA-1: 781c971d46f0cd6f174fa6b5cb6c4f1545057bb7 SHA-256: 1bc70985e7a7562edbccb1022d81cfda8bed14d34ac70005ddf5f87f6cebc600
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, indicating a link farm or a distribution mechanism for further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-generating intent. No scripts were extracted, limiting the analysis of direct execution capabilities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gofieldorgohome.com/uploads/1/3/0/4/130435807/retonesex.pdf
    • http://theluckywood.com/uploads/1/3/0/5/130552097/xigekuvutagapod_wubikoxa_lopuvimubanu.pdf
    • http://nimigu.8765432.org/uploads/2020/01/28/xexaludok_jubegasi_kosap_tolaratilozid.pdf
    • http://potafagi.feierverkspb.ru/uploads/2020/01/27/mikoluluwomatunekim.pdf
    • http://rebellioussubjects.com/uploads/1/3/0/5/130550667/8393683.pdf
    • http://owecopqak.icu/uploads/2020/01/28/4d79a90bfb1d0.pdf
    • http://saffrondemenezes.com/uploads/1/3/0/2/130289792/difug.pdf
    • http://konogaj.jitoli.icu/uploads/2020/01/28/samajukasibepuvoj.pdf
    • https://kijopaleroju.weebly.com/uploads/1/3/0/4/130435839/245cb14508.pdf
    • http://goujonnygoujon.com/uploads/1/3/0/4/130435710/bonefikife_sexomaxize.pdf
    • http://wishfulvintage.com/uploads/1/3/0/6/130604887/79276400ad796c8.pdf
    • https://zobegubitabid.weebly.com/uploads/1/3/0/2/130289204/betoniwodet.pdf
    • http://jibupeza.lorkabinet.ru/uploads/2020/01/27/sevobud-fuguzuk-jemunerilijire-gaxovujajaforu.pdf
    • http://poniji.w7and.net/uploads/2020/01/27/zivarilegaranib-figorogiroz-noxitu.pdf
    • http://bisozab.fohow64.ru/uploads/2020/01/28/1137382.pdf
    • http://lofibufax.vodabur1.ru/uploads/2020/01/27/db015c8ac35a32.pdf
    • http://lore.7x4.ru/uploads/2020/01/28/2548875.pdf
    • http://basexixej.betterqualityreviews.com/uploads/2020/01/29/8383495.pdf
    • https://lexaputare.weebly.com/uploads/1/3/0/5/130550803/9e6c97c2.pdf
    • http://geves.lcmevents.com/uploads/2020/01/28/36b4cf3950.pdf
    • http://girilya.com/uploads/1/3/0/4/130435803/8ea24362263c.pdf
    • http://market-ress.com/uploads/1/3/0/6/130620555/renewuwabuwep.pdf
    • http://kcbevco.com/uploads/1/3/0/6/130620973/130620973.html#%C3%B6%C4%9Fretmen+g%C3%B6zlem+formu

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001876.bin
2e102d65eeba769f302e09853cc39407d065851d876f15a4bdc8798afd540443		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1876 9544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.