Malicious PDF — malware analysis report

Static analysis result for SHA-256 4124a704db9054ab…

MALICIOUS

PDF

41.3 KB Authoring application: SWFTools First seen: 2020-09-24
MD5: 882b7300a08dbcf1b3a74857694115fb SHA-1: 69b22b9e5742c1f2891bbfb521114a7b36604e57 SHA-256: 4124a704db9054abc89c5400b3d591bd6e6ce6e6e8d98fcf35a0469d413d662c
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content. ClamAV identified this file as Pdf.Phishing.TtraffRobotInstall-7605656-0, indicating a phishing or traffic redirection intent. The document body itself is heavily obfuscated and does not provide clear user-facing content, but the heuristic firings strongly suggest a malicious purpose related to link farming and potential phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myartscout.com/uploads/1/3/0/4/130488891/masogi-rifovorumo-sapivojokelew.pdf In PDF document text
    • http://nsksstaffers.com/uploads/1/3/0/5/130589131/5069362.pdfIn PDF document text
    • http://schulzlegal.ca/uploads/1/3/0/3/130323146/niwewopog_befuzupakuj.pdfIn PDF document text
    • http://corazondemujer.net/uploads/1/3/0/6/130620807/7306123.pdfIn PDF document text
    • http://miamicustomtours.com/uploads/1/3/0/2/130289736/6333114.pdfIn PDF document text
    • http://oscarchavezphotography.net/uploads/1/3/0/6/130621333/puditekixuxubabu.pdfIn PDF document text
    • http://theporkfat.com/uploads/1/3/0/7/130739368/vasudizuzo.pdfIn PDF document text
    • http://polato.net/uploads/1/3/0/5/130543467/sobovepup.pdfIn PDF document text
    • http://midcenturymomern.com/uploads/1/3/0/7/130740090/5894c6.pdfIn PDF document text
    • http://enterprisesoftwarealternatives.com/uploads/1/3/0/2/130287862/nigavodel.pdfIn PDF document text
    • http://theophilusministry.org/uploads/1/3/0/2/130270742/2849602.pdfIn PDF document text
    • http://merakicuts.com/uploads/1/3/0/4/130483808/3052431.pdfIn PDF document text
    • http://mudgleyholidayhouse.com/uploads/1/3/0/6/130603943/fae86a5328.pdfIn PDF document text
    • http://icebergholdings.com/uploads/1/3/0/6/130620574/feledop-bemim.pdfIn PDF document text
    • http://vivienne-egan.com/uploads/1/3/0/6/130639712/vonopipiz.pdfIn PDF document text
    • http://searchdmd.com/uploads/1/3/0/7/130739607/2170020.pdfIn PDF document text
    • http://dentnow-sc.com/uploads/1/3/0/7/130740097/wovawafebapem.pdfIn PDF document text
    • http://genasurphlis.com/uploads/1/3/0/2/130270971/4124a382.pdfIn PDF document text
    • http://mvmaxclinicadeginastica.com/uploads/1/3/0/4/130476309/vozopezu.pdfIn PDF document text
    • http://motorshare.org/uploads/1/3/0/2/130273610/2d83ff.pdfIn PDF document text
    • http://mail.knox-graceec.org/uploads/1/3/0/8/130813364/saguzivoguku.pdfIn PDF document text
    • http://diffclock.com/uploads/1/3/0/4/130435518/ed05265.pdfIn PDF document text
    • http://boyde-studios.com/uploads/1/3/0/5/130550665/fajozejokewol.pdfIn PDF document text
    • http://tuitionhotsauce.com/uploads/1/3/0/8/130874647/130874647.html#acey+deucey+card+game+oddsIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E99 8224 bytes
SHA-256: d77053cc18cf9f0ebb60c4a1ce8c8b0b80fafa628ca043c7a502c7cbdd161030

Open this report in the interactive analyzer, or submit your own file for analysis.