Malicious PDF — malware analysis report

Static analysis result for SHA-256 4124a704db9054ab…

MALICIOUS

PDF

41.3 KB Authoring application: SWFTools
MD5: 882b7300a08dbcf1b3a74857694115fb SHA-1: 69b22b9e5742c1f2891bbfb521114a7b36604e57 SHA-256: 4124a704db9054abc89c5400b3d591bd6e6ce6e6e8d98fcf35a0469d413d662c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content. ClamAV identified this file as Pdf.Phishing.TtraffRobotInstall-7605656-0, indicating a phishing or traffic redirection intent. The document body itself is heavily obfuscated and does not provide clear user-facing content, but the heuristic firings strongly suggest a malicious purpose related to link farming and potential phishing.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myartscout.com/uploads/1/3/0/4/130488891/masogi-rifovorumo-sapivojokelew.pdf
    • http://nsksstaffers.com/uploads/1/3/0/5/130589131/5069362.pdf
    • http://schulzlegal.ca/uploads/1/3/0/3/130323146/niwewopog_befuzupakuj.pdf
    • http://corazondemujer.net/uploads/1/3/0/6/130620807/7306123.pdf
    • http://miamicustomtours.com/uploads/1/3/0/2/130289736/6333114.pdf
    • http://oscarchavezphotography.net/uploads/1/3/0/6/130621333/puditekixuxubabu.pdf
    • http://theporkfat.com/uploads/1/3/0/7/130739368/vasudizuzo.pdf
    • http://polato.net/uploads/1/3/0/5/130543467/sobovepup.pdf
    • http://midcenturymomern.com/uploads/1/3/0/7/130740090/5894c6.pdf
    • http://enterprisesoftwarealternatives.com/uploads/1/3/0/2/130287862/nigavodel.pdf
    • http://theophilusministry.org/uploads/1/3/0/2/130270742/2849602.pdf
    • http://merakicuts.com/uploads/1/3/0/4/130483808/3052431.pdf
    • http://mudgleyholidayhouse.com/uploads/1/3/0/6/130603943/fae86a5328.pdf
    • http://icebergholdings.com/uploads/1/3/0/6/130620574/feledop-bemim.pdf
    • http://vivienne-egan.com/uploads/1/3/0/6/130639712/vonopipiz.pdf
    • http://searchdmd.com/uploads/1/3/0/7/130739607/2170020.pdf
    • http://dentnow-sc.com/uploads/1/3/0/7/130740097/wovawafebapem.pdf
    • http://genasurphlis.com/uploads/1/3/0/2/130270971/4124a382.pdf
    • http://mvmaxclinicadeginastica.com/uploads/1/3/0/4/130476309/vozopezu.pdf
    • http://motorshare.org/uploads/1/3/0/2/130273610/2d83ff.pdf
    • http://mail.knox-graceec.org/uploads/1/3/0/8/130813364/saguzivoguku.pdf
    • http://diffclock.com/uploads/1/3/0/4/130435518/ed05265.pdf
    • http://boyde-studios.com/uploads/1/3/0/5/130550665/fajozejokewol.pdf
    • http://tuitionhotsauce.com/uploads/1/3/0/8/130874647/130874647.html#acey+deucey+card+game+odds
    • http://miamicustomtours.com/uploads/1/3/0/2/130289

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e99.bin
d77053cc18cf9f0ebb60c4a1ce8c8b0b80fafa628ca043c7a502c7cbdd161030		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E99 8224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.