Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f97dd4b927a5f43…

MALICIOUS

PDF

38.9 KB Authoring application: SWFTools
MD5: c0751a594905742cd09d386cf72d1b33 SHA-1: edd247985912902270f98c123282879e409aab2c SHA-256: 4f97dd4b927a5f43dabbe12c61ac9b376b3108fa67a37acab36f2f9fdf369135
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits characteristics of a phishing lure, as indicated by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of a large number of embedded external links. The heuristic 'PDF_SEO_LINK_FARM' strongly suggests an attempt to manipulate search engine results or redirect users to malicious content. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document may be instructing the user to open a password-protected archive, a common tactic to bypass gateway security. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://christinetschida.com/uploads/1/3/0/6/130604264/835036037.pdf
    • http://theatlantadoula.com/uploads/1/3/0/6/130621989/riposerare-suvilurope-kabalugaluxukod.pdf
    • http://zoolr.com/uploads/1/3/0/2/130272848/117071.pdf
    • http://sarkarweb.com/uploads/1/3/0/2/130288533/ea8188c710064.pdf
    • http://bourbonhome.com/uploads/1/3/0/4/130476146/vepufixave-rasamofokivilo.pdf
    • http://btmamusic.com/uploads/1/3/0/6/130605399/030bb8b9766400f.pdf
    • http://mirageestates.com/uploads/1/3/0/6/130605083/6942644.pdf
    • http://northernlightspace.com/uploads/1/3/0/6/130621997/2395755.pdf
    • http://blog.tastefuljourneys.com/uploads/1/3/0/4/130489351/lapoxivavit.pdf
    • http://freespiritgirl.com/uploads/1/3/0/6/130621530/4f4193f996008d.pdf
    • http://shop.coquito.us/uploads/1/3/0/6/130639629/484156cfeb92.pdf
    • http://mjrich.net/uploads/1/3/0/4/130476678/755146.pdf
    • http://jimmymachomeservices.com/uploads/1/3/0/2/130289019/5169875.pdf
    • http://silvercloudvape.co.uk/uploads/1/3/0/7/130775630/a113d.pdf
    • http://mta-sts.mail.kpwclaims.com/uploads/1/3/0/2/130291449/130291449.html#realflow+plugin+for+3ds+max+2013+free+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c3c.bin
6561a6a544ed2f9990d04965c20e3fab3f1743964fbe02b2a9d6c3274140f784		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C3C 8720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.