Malicious PDF — malware analysis report

Static analysis result for SHA-256 a86ba6c634aa9d4b…

MALICIOUS

PDF

55.9 KB Authoring application: SWFTools
MD5: a1597868974314ccb4e4fe995807ff52 SHA-1: 54f0b6cf9582317776b48e71359cf95cdfd89a4f SHA-256: a86ba6c634aa9d4b0db05654083759ffd1b7848c174c6393f32d18ddacf7919a
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files hosted on various domains, indicating a link farm or redirection scheme. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of urgency and download button lures further support a phishing or malicious download attempt. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beachfrontcondosfl.com/uploads/1/3/0/6/130603980/8d7f9.pdf
    • http://jtslawncare.org/uploads/1/3/0/5/130550970/9527376.pdf
    • http://gypsyschindler.com/uploads/1/3/0/6/130604419/saxerotul.pdf
    • http://ryanmurrayconductor.com/uploads/1/3/0/6/130604424/6546257.pdf
    • http://cahoje.com/uploads/1/3/0/2/130289553/jedusuvipulemene.pdf
    • http://northwestfineartstudio.com/uploads/1/3/0/7/130776436/30a050b97009e.pdf
    • http://shannaspetsupply.com/uploads/1/3/0/2/130291572/wibujigo-repenudijizovir.pdf
    • http://finstudio.org/uploads/1/3/0/7/130775806/regaluvozinuvix.pdf
    • http://michellesusanmarketing.com/uploads/1/3/0/5/130539742/jatefazumuvolif.pdf
    • http://dbtdelaware.com/uploads/1/3/0/2/130287923/44576a051d8e524.pdf
    • http://splitfingerstudio.com/uploads/1/3/0/6/130639709/bikizenenezobu_bibevetiz.pdf
    • http://discountclosetspecialist.com/uploads/1/3/0/5/130590195/f75fad.pdf
    • http://absystemsllcscam.com/uploads/1/3/0/4/130476611/130476611.html#translate+mandarin+to+english+website

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000136d.bin
30b4ec2b8e263937ed1e54554f3457ed12cc7d1813b3a3883ecaa403db14b264		 pdf-font-stream PDF embedded font (sfnt) at offset 0x136D 9100 bytes
font_01_sfnt_off0000751e.bin
bde708d1085e5a0efe6c8f6e9c97380408e1fd40bab0205a93808ba06c379965		 pdf-font-stream PDF embedded font (sfnt) at offset 0x751E 10076 bytes
font_02_sfnt_off00009455.bin
11a74f49d765dd1e1de36782c14460799e5a15aada65558312b1167e44b4bb62		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9455 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.