Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c95fc343924399a…

MALICIOUS

PDF

64.9 KB Authoring application: SWFTools
MD5: 56e482d07ad8dbe477fab5374f19546c SHA-1: a25af614a9b02ee41f72f237882d07e76052c6cb SHA-256: 3c95fc343924399aa594baf4f135ca6808e69fa0aa194cb2adf93ea676a8c684
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is consistent with a link farm or a phishing campaign designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.adulttoyclub.com/uploads/1/3/0/5/130543684/9216815.pdf
    • http://iqfee.com/uploads/1/3/0/6/130639607/9303144.pdf
    • http://nancebmecleaning.com/uploads/1/3/0/7/130775076/c89d2507a4.pdf
    • http://abracadabra.soy/uploads/1/3/0/6/130603771/4882070.pdf
    • http://calasanzpbavaro.edu.do/uploads/1/3/0/6/130621989/jenoxotuvaraxekipome.pdf
    • http://thewhyissue.com/uploads/1/3/0/6/130603772/rumaduzepozopedumat.pdf
    • http://btctree.net/uploads/1/3/0/6/130622022/dujoson.pdf
    • http://www.ndpafunrun.com/uploads/1/3/0/6/130620928/furitigiwax_fakogum_geroxural_kanig.pdf
    • http://www.lydlydcastorena.com/uploads/1/3/0/8/130814076/3257929.pdf
    • http://proschconsulting.com/uploads/1/3/0/5/130590777/3181294.pdf
    • http://getitgatorauto.com/uploads/1/3/0/3/130313082/sigigawab_viponiga_waxek.pdf
    • http://www.premiermushrooms.com/uploads/1/3/0/5/130539913/95956.pdf
    • http://paxiarecords.com/uploads/1/3/0/2/130273791/zakewejebalu_duluvezagubo_nuvenewekofudu.pdf
    • http://tinjaw.net/uploads/1/3/0/8/130874523/2406054.pdf
    • http://falaliyulechengbaijialehaowan.br3h.com/uploads/1/3/0/5/130551325/130551325.html#example+of+categorical+imperative+ethics

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012eb.bin
87bb6dff9264fdcd975d8b076099bbaed17d4b6064075e548d09a18cf64fa7bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EB 8896 bytes
font_01_sfnt_off0000ad3b.bin
83d89f79375f7f339e88070a8779324ce221c94923bff415e388e162fbc46cfe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAD3B 2604 bytes
font_02_sfnt_off0000b5e1.bin
98958365168029d4f54c753cd9186d92cfe6c3bbbc0f7ce7585e6a5e6ab2bca4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB5E1 16040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.