Malicious PDF — malware analysis report

Static analysis result for SHA-256 95525264a09a9ffc…

MALICIOUS

PDF

37.5 KB Authoring application: SWFTools
MD5: 756dbd876ee51364a5b6583a7d8a7b48 SHA-1: 5451eb95096fede15958eb6bcf0d54b82a3e723e SHA-256: 95525264a09a9ffcf4d83e9d05c19dda9c11e71ee15830fe4c8b406eed01ae8a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chinaesp.net/uploads/1/3/0/5/130588611/38028184c69a.pdf
    • http://mytexaschamber.com/uploads/1/3/0/3/130323422/funuruva_vutuzudap_befatukarof_tenomaf.pdf
    • http://sexoembrasilia.com/uploads/1/3/0/2/130273623/bakamiz_kefuzi_zujuwirabeli_ripanugi.pdf
    • http://davidhoover.net/uploads/1/3/0/6/130604904/japobozogupekavam.pdf
    • http://scubatribemaldives.com/uploads/1/3/0/6/130620563/gogutigutozomume.pdf
    • http://naughtybottom.net/uploads/1/3/0/2/130274098/e2f56fd4f6557.pdf
    • http://damorse.com/uploads/1/3/0/6/130604114/denijosarikozu.pdf
    • http://motolegendsusa.com/uploads/1/3/0/5/130538891/1dd90bbb.pdf
    • http://advance-it.net/uploads/1/3/0/6/130620863/130620863.html#ielts+speaking+topics+liz

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011dc.bin
be9440ccb64173cf5dfe8e6feb2499dfd45163fae6e28497db544962cea5dab9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DC 8232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.