Malicious PDF — malware analysis report

Static analysis result for SHA-256 aaee84ca6badbf62…

MALICIOUS

PDF

43.5 KB Authoring application: SWFTools
MD5: 8aa96cd62f94a3485f84bab59e177534 SHA-1: e72a08810b3a93ed7371581a4032a86239e26387 SHA-256: aaee84ca6badbf62c53be029d9e98c761c000f197b3194b7ff3d533326d6f160
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://maisonbouche.net/uploads/1/3/0/4/130483286/46645.pdf
    • http://tappchicago.com/uploads/1/3/0/7/130739185/tifakozasaju-xaresefojab-kadutew.pdf
    • http://icbrconference.com/uploads/1/3/0/6/130639554/a5c36dc3fabd7.pdf
    • http://www.smsbennett.com/uploads/1/3/0/6/130640025/dutorosizikiramur.pdf
    • http://onezzzz.com/uploads/1/3/0/7/130739907/jepokuvudari.pdf
    • http://physicianmummyuk.com/uploads/1/3/0/6/130640111/4807950.pdf
    • http://westcoastwebleads.com/uploads/1/3/0/6/130620631/benelex.pdf
    • http://iamprovidence.net/uploads/1/3/0/6/130620626/kokezu_dogikafimoge_wamagurufovunu.pdf
    • http://completefitnessnutrition.com/uploads/1/3/0/4/130435715/leruniwas-rediteravab-pivunitepivol.pdf
    • http://arlingtonmeet.com/uploads/1/3/0/7/130739975/ad36ae6d.pdf
    • http://mvnhs.org/uploads/1/3/0/7/130775260/26f3f2.pdf
    • http://middlesistercocktails.net/uploads/1/3/0/5/130546759/zowarikesutewote.pdf
    • http://mx.deltamaintenance.ca/uploads/1/3/0/8/130814411/51070.pdf
    • http://sorteincorporation.co.za/uploads/1/3/0/5/130551096/0a78528b194d.pdf
    • http://newenglandsunroomrepair.com/uploads/1/3/0/2/130289532/wetozewodivofiki.pdf
    • http://taoshayulechengkaihudizhi.f18.ebkf.org/uploads/1/3/0/6/130620402/8281704.pdf
    • http://greyowlproperties.com/uploads/1/3/0/4/130476700/ed568f.pdf
    • http://refinanceaurora.com/uploads/1/3/0/4/130483956/rexenikigitisudoga.pdf
    • http://liverocks.net/uploads/1/3/0/4/130476740/a2767bc.pdf
    • http://www.tarahasselbeck.com/uploads/1/3/0/6/130603985/mozavomunano.pdf
    • http://hangmyboard.com/uploads/1/3/0/6/130639233/dilikibiz.pdf
    • http://kpsmusik.com/uploads/1/3/0/6/130621048/130621048.html#causes+of+peptic+ulcers+in+infants
    • http://iamprovidence.net/uploads/1/3/0/6/1306206

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048fd.bin
e90c6f3d83859562d595b64ab2bbb3c0ef5a17b4d945eee22e3335873ab3bc2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48FD 8212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.