Malicious PDF — malware analysis report

Static analysis result for SHA-256 95e9d2af52e864f2…

MALICIOUS

PDF

40.6 KB Authoring application: SWFTools
MD5: 57499fd9e5c8e0a49e91bfdf4e584ec2 SHA-1: 3a67398ba51a6a7e00aa8eb61298cd8aff2a0fce SHA-256: 95e9d2af52e864f292ecb010edb0046bfe3588df6c37e7a8895aeb9afd702bff
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body itself is heavily obfuscated and does not provide clear user-facing text, but the heuristic firings strongly suggest a malicious intent related to phishing or malware distribution through these linked PDFs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://katiegracecollins.com/uploads/1/3/0/5/130538953/5872777.pdf
    • http://avalonbusinessconsulting.net/uploads/1/3/0/7/130739398/fexab_zuzimuvedafebap_supibematezok_losezur.pdf
    • http://alisasapothecurious.com/uploads/1/3/0/5/130550742/4e34a.pdf
    • http://midsomersetmartialarts.com/uploads/1/3/0/5/130551387/948c89.pdf
    • http://www.east-orange-girl-that-code-nj-11-032.com/uploads/1/3/0/2/130272232/7214566.pdf
    • http://agedcarecertiii.com.au/uploads/1/3/0/2/130291029/sazemodiboruxexaj.pdf
    • http://energykim.com/uploads/1/3/0/6/130605505/072ead.pdf
    • http://mamadomamadont.com/uploads/1/3/0/6/130604420/ac61c0828ad915.pdf
    • http://elizabethbrowndesign.com/uploads/1/3/0/4/130435753/nitigin.pdf
    • http://thisisbourboncountry.net/uploads/1/3/0/2/130271158/rasemiriw.pdf
    • http://smartboardclub.com/uploads/1/3/0/5/130550823/sexek.pdf
    • http://bozhidaoyulechengguanwang.br3h.com/uploads/1/3/0/2/130270918/130270918.html#assassin%27s+creed+origins+walkthrough+papyrus

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004832.bin
bb50cd975997f0558949e9c533e5dc402d3908f35786921f2b7e31449e34a2a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4832 7836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.