Malicious PDF — malware analysis report

Static analysis result for SHA-256 55acfc919795a158…

MALICIOUS

PDF

45.4 KB Authoring application: SWFTools
MD5: 57f6ca5373eeb7d8642b1104b6f0f406 SHA-1: 4434ac309152270ae33127e55e86bbb07b509ab6 SHA-256: 55acfc919795a158e8455aac2af5b5b7c3387322ed1ae79e58a6abbf643d9839
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to other PDF files hosted on various domains, suggesting a link farm or a distribution network for malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or traffic-driving intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://heeratees.com/uploads/1/3/0/6/130620510/jasiv_letaxuwojuvu.pdf
    • http://davidmarquesibanez.com/uploads/1/3/0/3/130379174/paxibexod.pdf
    • http://musgroverentals.com/uploads/1/3/0/8/130874593/1227694.pdf
    • http://choicecutengraving.com/uploads/1/3/0/6/130603761/3233651.pdf
    • http://cpanel.brockhousenurserystalbans.co.uk/uploads/1/3/0/2/130271143/1a3a33cd74c4c.pdf
    • http://nortegrandeenelmundo.com/uploads/1/3/0/5/130551441/tabivojogod_rujamekof_mefuvixerulod.pdf
    • http://dealswithdessy.com/uploads/1/3/0/5/130551106/9ca03a3752c644.pdf
    • http://35andunder.com/uploads/1/3/0/4/130489072/b8e76cf4b.pdf
    • http://gosapar.com/uploads/1/3/0/4/130483412/gebunovudal.pdf
    • http://upholsterysewingmachine.net/uploads/1/3/0/6/130620693/vepidite_jenov.pdf
    • http://topabudhabi.com/uploads/1/3/0/2/130272509/tanal_bajezaxomeluva_zorodujijibu.pdf
    • http://www.anchorstoragelc.com/uploads/1/3/0/6/130620841/7982971.pdf
    • http://nazproekt.com/uploads/1/3/0/3/130379743/tovobodobimivusid.pdf
    • http://www.impactinglivesfoundation.org/uploads/1/3/0/6/130639872/9105684.pdf
    • http://romanacoutureshop.com/uploads/1/3/0/7/130776823/kexikupasikola.pdf
    • http://sofiebal.com/uploads/1/3/0/7/130776684/7210206.pdf
    • http://mail.gotapulse.com/uploads/1/3/0/6/130639363/72383078.pdf
    • http://teamanteater.us/uploads/1/3/0/3/130323412/3807c2.pdf
    • http://smtbeauty.net/uploads/1/3/0/9/130969283/4339250.pdf
    • http://bostonlasertech.com/uploads/1/3/0/5/130588833/dozerutedof-manudorajiboke.pdf
    • http://romandarnielle.com/uploads/1/3/0/7/130739387/vuwakir-zasamedi-jizejolegov-pupuxenajajivuf.pdf
    • http://repealcongress.com/uploads/1/3/0/6/130620263/2395b2d7f339.pdf
    • http://puppettearspod.com/uploads/1/3/0/2/130270845/kodas.pdf
    • http://ajointvisionllc.com/uploads/1/3/0/6/130604317/xalufawu_xaxibarujifoze_sevifavawopik_zulane.pdf
    • http://powerofproton3.website/uploads/1/3/0/6/130620561/xabowo.pdf
    • http://n4rm3a.salon225.com/uploads/1/3/0/2/130289494/130289494.html#how+do+you+edit+text+in+bluebeam
    • http://nortegrandeenelmundo.com/uploads/1/3/0/5/130551441/t

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e69.bin
56d90e20be5cb8ca6ba0eacbe1be099609102025820949d0eed95c7d44cb358f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E69 7584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.