Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad2bbec6b97e3caf…

MALICIOUS

PDF

38.1 KB Authoring application: SWFTools
MD5: 82a990658b77d84b77945f23cdef0107 SHA-1: 721f6fa3e7db247b81f72e0eb423534b665b0390 SHA-256: ad2bbec6b97e3caf96cd543e1ee419259d7758d3851a21c366a8004a529bf92b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1566.002 Phishing:Spearphishing Link

The PDF file contains a large number of embedded URLs pointing to other PDF files, indicating a link farm or redirection mechanism. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic-generation intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external links, likely designed to manipulate search engine results or direct users to malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sipefududo.art44.ru/uploads/2020/01/27/3223258.pdf
    • http://bristolberlinvintage.com/uploads/1/3/0/6/130621803/f1ec50e651cd30.pdf
    • http://hobekuntzapsicologia.com/uploads/1/3/0/5/130589431/888aa.pdf
    • http://propellersound.ca/uploads/1/3/0/5/130590339/6883955.pdf
    • http://kforkaveh.no/uploads/1/3/0/5/130588749/c8789e05b91.pdf
    • http://muckaboutpottery.weebly.com/uploads/1/3/0/5/130551302/3110330.pdf
    • http://michianadrugtestingcenter.com/uploads/1/3/0/5/130551248/3246778.pdf
    • http://coastal-kb.com/uploads/1/3/0/2/130287845/1364371.pdf
    • http://facileglutenfree.it/uploads/1/3/0/5/130544147/7487250.pdf
    • http://hoodoohemp.com/uploads/1/3/0/2/130271023/wureretaboxiw.pdf
    • http://jibat.novostroyki-barnaul.ru/uploads/2020/01/29/tikejikasodaj.pdf
    • http://nopeka.ethereumbanking.org/uploads/2020/01/29/8262674.pdf
    • http://duju.kubrinsk.ru/uploads/2020/01/28/wejikebuwede-wubisezemununa.pdf
    • http://bandstore.net/uploads/1/3/0/6/130639278/kifimitapi_betatiboguz_kizeminugeza_zuzidukofamewo.pdf
    • http://floridasnowicecream.com/uploads/1/3/0/6/130621640/1450143.pdf
    • http://magdasita.studio/uploads/1/3/0/5/130539227/vobazekojug-litumitadufili-lasaxewolu.pdf
    • http://courtneyfiles.com/uploads/1/3/0/5/130589431/dirisedev.pdf
    • http://zhangxiaoyan.info/uploads/1/3/0/3/130313491/fee9cd7ef8a35.pdf
    • https://xetizurubajo.weebly.com/uploads/1/3/0/6/130604804/7d9f78d488a5.pdf
    • http://nuvapejago.zorfa.icu/uploads/2020/01/29/6650441.pdf
    • http://djsacademy.com/uploads/1/3/0/5/130588239/130588239.html#wlan+passwort+gespeichert+auslesen+android

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015d6.bin
fa031c83e897f7610f02e5fade62c46db474569022cf25a5c65ef31bfa6d9100		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15D6 8584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.