Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bec20fd43f543c3…

MALICIOUS

PDF

49.2 KB Authoring application: SWFTools
MD5: e32367c3c968437b47b44aff595e96f0 SHA-1: 46a7044d6b97ba31297790396a9c0fb9b5ff2fb0 SHA-256: 1bec20fd43f543c33b9665da9c144d1d9e53844533ba3d0c9bf0ebef03f4f0a8
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files. This is indicative of a link farm designed to manipulate search engine results or to lure users into downloading further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file. The presence of a visual download button, though low-signal on its own, reinforces the lure-based attack pattern.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://breathlifeministries.com/uploads/1/3/0/6/130604321/vomajiguzovok.pdf
    • http://marlinjames.org/uploads/1/3/0/6/130605388/nilozusopab-turowixu-wosekikod-kadopi.pdf
    • http://microschoolontherise.com/uploads/1/3/0/5/130550914/desugojezuvek.pdf
    • http://suzannesamin.com/uploads/1/3/0/6/130604977/244873acadcd.pdf
    • http://hannahunter.com/uploads/1/3/0/3/130323647/d430b0.pdf
    • http://silvabuildings.com/uploads/1/3/0/6/130620788/072e7c8092f2d.pdf
    • http://74-123-72-7.mgwnet.com/uploads/1/3/0/2/130289510/gobexopun.pdf
    • http://andreassuter.com/uploads/1/3/0/2/130291463/7115145.pdf
    • http://revbevwaring.com/uploads/1/3/0/6/130620581/da9e68a.pdf
    • http://naveedsonikamembers.com/uploads/1/3/0/7/130739625/wapifipuv.pdf
    • http://www.conciearth.com/uploads/1/3/1/0/131069863/e501d1f552b3e1.pdf
    • http://malzak.com.au/uploads/1/3/0/5/130590305/mugizituzu_pasowaluvidotof.pdf
    • http://sabyhage.se/uploads/1/3/0/4/130488172/4786bd58.pdf
    • http://witches.church/uploads/1/3/0/6/130640021/4478695.pdf
    • http://www.jmarieeventsmyd.com/uploads/1/3/0/2/130289799/c32799f.pdf
    • http://nikkirelford.com/uploads/1/3/0/5/130588640/bakari_mamaga.pdf
    • http://freexperience.net/uploads/1/3/0/5/130542692/4e04e7.pdf
    • http://hostmaster.pawsplayground.co.uk/uploads/1/3/0/6/130620460/lazalizas.pdf
    • http://createpowtoon.com/uploads/1/3/0/6/130603983/7643642.pdf
    • http://sipsandtripstravel.voyagerwebsites.com/uploads/1/3/0/5/130540281/130540281.html#fifa+world+cup+2018+song+download+mp4
    • http://www.conciearth.c

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d56.bin
1e291a59dcc22e9b60a5546e750da25651969c14ed591eb3514a262bd799a960
pdf-font-stream PDF embedded font (sfnt) at offset 0x3D56 2700 bytes
font_01_sfnt_off00004658.bin
cbc1593282731cd4ce9b81b4e1b210e481f0609e289dd96b6df4697bdff89ebc
pdf-font-stream PDF embedded font (sfnt) at offset 0x4658 16168 bytes
font_02_sfnt_off00005e92.bin
7fa791571359620effdee70d375ff32d55a7f14a3a234ca4062c64326eca6c5a
pdf-font-stream PDF embedded font (sfnt) at offset 0x5E92 9144 bytes