Malicious PDF — malware analysis report

Static analysis result for SHA-256 54b620ee9bb2def2…

MALICIOUS

PDF

43.0 KB Authoring application: SWFTools
MD5: 42793fb12627192c737dcc24aa713fff SHA-1: 114e04cca32d953b302fa27b2889a5014c251f68 SHA-256: 54b620ee9bb2def28d8d47fd82c6f225a43ed978c8734bc11934fe56aa0e51be
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body itself is heavily obfuscated and contains some of the same URLs, reinforcing the idea that the primary function is to redirect users to these external resources.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://50staaten.com/uploads/1/3/0/6/130620309/kufojunusafosafa.pdf
    • http://mrpodmers.com/uploads/1/3/0/6/130620704/wapas_fijof_kunapi.pdf
    • http://equipajedemano.com/uploads/1/3/0/2/130289310/4099137.pdf
    • http://bravesblog.com/uploads/1/3/0/7/130739889/3627879.pdf
    • http://ninejazz.com/uploads/1/3/0/2/130289355/d61fa1aa.pdf
    • http://btaccountingandtax.com/uploads/1/3/0/3/130313359/palagaradezowo.pdf
    • http://jfainnovative.com/uploads/1/3/0/6/130639034/8561d3a705b030.pdf
    • http://betteryet.net/uploads/1/3/0/5/130539115/dazorezaxo.pdf
    • http://thefashionablefarmgirl.com/uploads/1/3/0/3/130379844/9465162.pdf
    • http://mobileweldingservice.co/uploads/1/3/0/6/130621096/tugonirowebawa_guxafonulat.pdf
    • http://nutrizionistagiuliaporcu.it/uploads/1/3/0/5/130542894/roxud.pdf
    • http://somersetfoodtrail.org/uploads/1/3/0/6/130621243/130621243.html#gdpr+consent+form+templates

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012f7.bin
9461bf1f8c139d994b23a25042a815039b4dee19bad51592b5458eab96bc5d13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F7 8880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.