Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad232158bced3806…

MALICIOUS

PDF

70.7 KB Authoring application: SWFTools
MD5: 59f334a39fe52d9da803fd07960453ad SHA-1: 4eb1519c1b63b65c792179c67d2880344ee3057b SHA-256: ad232158bced3806cd5ab55c22123e7e5c076ed0da2705a4d6fd6f5114e7f62e
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded external links, many of which point to other PDF files. This behavior is indicative of a link farm designed to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. The document body, though heavily obfuscated, contains a list of URLs that are likely part of this distribution network.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://radiantlifeacademy.org/uploads/1/3/0/6/130639547/a90dbe57eb8b98.pdf
    • http://zokixese.0406shopps01.fun/uploads/2020/01/29/vosevikil-nowuneru.pdf
    • https://kawizugewel.weebly.com/uploads/1/3/0/5/130541188/0a377a255.pdf
    • http://paypass.pro/uploads/2020/01/28/86baa75.pdf
    • http://kirurofexu.firstcommonsense.com/uploads/2020/01/27/lomefoxu-savapumowi-kanepoxudasuze.pdf
    • http://tayadsy.tech/uploads/2020/01/27/gesibunivefugi.pdf
    • https://pokizizefavef.weebly.com/uploads/1/3/0/5/130588477/3716943.pdf
    • http://rooflocators.com/uploads/1/3/0/5/130551777/8344037.pdf
    • http://sovod.molodostbz.club/uploads/2020/01/28/492373defc65.pdf
    • https://rozegotaxot.weebly.com/uploads/1/3/0/4/130436318/1131535.pdf
    • http://nourishmarket.ca/uploads/1/3/0/5/130588964/nadowid_gebid_vefurivi_xiforope.pdf
    • http://rukireg.yukariyorum.org/uploads/2020/01/27/wipetoronanolagiref.pdf
    • http://rightofwaysolutionsllc.com/uploads/1/3/0/6/130620317/1966b0257b72a0.pdf
    • https://vuwizosub.weebly.com/uploads/1/3/0/2/130287238/5118856.pdf
    • http://motebe.myshop8.site/uploads/2020/01/28/d8d96fadd17646.pdf
    • https://nizikivinagunel.weebly.com/uploads/1/3/0/3/130379291/7793094.pdf
    • http://whatthefunkdenver.com/uploads/1/3/0/5/130539642/6208975.pdf
    • http://mgkindergarten.weebly.com/uploads/1/3/0/6/130639329/mamemi-bigef.pdf
    • http://mrsrcmath.weebly.com/uploads/1/3/0/3/130323522/tadaganad_jixemuvapipalu_rakubed_gejuzef.pdf
    • http://migorakuso.kamera360.ru/uploads/2020/01/27/1064290.pdf
    • http://thereadingrumpusroom.com/uploads/1/3/0/4/130476485/6698877.pdf
    • http://nvspconiond7o3soonion.pw/uploads/2020/01/28/xapujeru.pdf
    • http://vum.paulcotyantiques.com/uploads/2020/01/28/wolarobazasojug_jepatujuli_xewiguro.pdf
    • http://stmarysautorepairandsales.com/uploads/1/3/0/4/130478067/130478067.html#wow+engineering+guide

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017f0.bin
2b39233718cc40753d96c76702e94c1de981ea6de5de548bf952cbffd75ef56f
pdf-font-stream PDF embedded font (sfnt) at offset 0x17F0 8396 bytes
font_01_sfnt_off00006004.bin
6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60
pdf-font-stream PDF embedded font (sfnt) at offset 0x6004 16068 bytes