Malicious PDF — malware analysis report

Static analysis result for SHA-256 45b1f7316ce3f849…

MALICIOUS

PDF

41.3 KB Authoring application: SWFTools
MD5: 412111032e4134eb083690b88cf48628 SHA-1: 8482bebdc67d37e4dbb38ec36c8173393a810bda SHA-256: 45b1f7316ce3f84953b5ec215de2ac1ac88a03166aa22cfbcfc9f156b8ca5e08
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to phishing or malware distribution sites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. The document body, though partially corrupted, mentions 'Dental handpiece maintenance pdf', suggesting a lure to disguise the malicious link farm.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ministermichealburton.com/uploads/1/3/0/4/130436204/jabovoguw_kasebolixese_womenegomeva_defelasitoxu.pdf
    • http://wendtauto.com/uploads/1/3/0/5/130550981/6938226.pdf
    • http://northglennfootball.com/uploads/1/3/0/5/130543285/5580993.pdf
    • http://judgeammendola.com/uploads/1/3/0/5/130551839/75669.pdf
    • http://merakiimeasure.com/uploads/1/3/0/3/130379821/abb377.pdf
    • http://silvercloudvape.co.uk/uploads/1/3/0/5/130551517/1397b7.pdf
    • http://baysideoakland.com/uploads/1/3/0/5/130588763/regozula.pdf
    • http://moniquemccrayjackson.com/uploads/1/3/0/6/130604968/2533771.pdf
    • http://sufistudies.org/uploads/1/3/0/5/130589423/39182.pdf
    • http://springvillehighblt.org/uploads/1/3/0/2/130271094/telizul.pdf
    • http://merbuteo.com/uploads/1/3/0/7/130776358/vedog.pdf
    • http://advance-it.net/uploads/1/3/0/7/130739288/130739288.html#dental+handpiece+maintenance+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012eb.bin
ee7f40b20b5e2198ff31da5c85e5420fd8f98b69783f217fc623f3f8ae286000		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EB 9436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.