Malicious PDF — malware analysis report

Static analysis result for SHA-256 963fd9b6e1b69c53…

MALICIOUS

PDF

36.5 KB Authoring application: SWFTools
MD5: 501818e8aab0eaa06ca20a2b66117a57 SHA-1: 0bb926d5fa4dd34a0aabda2ed255d4ff19b45c7a SHA-256: 963fd9b6e1b69c532890e05c103ff6c83b93878c86c043069f8115e5b2903941
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm designed to distribute malicious content or conduct phishing attacks. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://davidmarquesibanez.com/uploads/1/3/0/5/130588803/waxufetenofo_gozaseforavise_virapewewikava_votemonosulaxe.pdf
    • http://stephaniepereira.com/uploads/1/3/0/6/130604449/987506.pdf
    • http://paramountbuilders.co.uk/uploads/1/3/0/5/130588816/6874581.pdf
    • http://babyg-lash.com/uploads/1/3/0/4/130483660/6516283.pdf
    • http://susansgardenminipigs.com/uploads/1/3/0/3/130323405/wokuzevaju_julagovewemax_buwuramaz.pdf
    • http://lovejanaco.com/uploads/1/3/0/7/130775853/35f285bc5a18b.pdf
    • http://challengetosociety.org/uploads/1/3/0/7/130775912/3547195.pdf
    • http://starboardopportunitypartners.com/uploads/1/3/0/7/130775674/waxise.pdf
    • http://aninnocentvictim.com/uploads/1/3/0/8/130813738/raboramusagefifegik.pdf
    • http://thespectrumnetwork.net/uploads/1/3/0/7/130776571/6ff7cd8c0b5a.pdf
    • http://sirenessong.com/uploads/1/3/0/7/130740612/6122576.pdf
    • http://bunniesareus.com/uploads/1/3/0/7/130739144/wuwugorat.pdf
    • http://mail.nickmosca.com/uploads/1/3/0/6/130604153/bovanusavazopojojug.pdf
    • http://xxx666xxx.site/uploads/1/3/0/4/130435960/filolubame.pdf
    • http://noyirionworks.com/uploads/1/3/0/6/130639591/zuwamemowe-somefunej-mopolejepimo-wiwil.pdf
    • http://www.fccabaret.com/uploads/1/3/0/6/130640191/130640191.html#century+21+accounting+general+journal+10th+edition+pdf
    • http://stephaniepereir

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003394.bin
5bb0f5727d9142a1c04dc4da9ce89be11e99ddc1621c73ed3e5ab9fda597ff4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3394 7892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.