Malicious PDF — malware analysis report

Static analysis result for SHA-256 affdc6bb05202528…

MALICIOUS

PDF

36.8 KB Authoring application: SWFTools
MD5: 564fcd4b9ee599f46d0109f7be7e1abc SHA-1: bb1a8158582b9b8fb4faeed36aa9b4c25c4524d4 SHA-256: affdc6bb05202528280ef822c819486077340562507644b0c7b487fc560206f2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of 31 external links, with the dominant host being 'fischertaketwo.com'. No scripts were extracted, limiting the analysis of direct execution behavior.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fischertaketwo.com/uploads/1/3/0/5/130589399/jajidopeloxex-xeviruji-fowamojerodun.pdf
    • http://cincoranchpoolbuilders.com/uploads/1/3/0/6/130604025/jabis.pdf
    • http://houseofgreenapparel.com/uploads/1/3/0/6/130621354/31379e4feb.pdf
    • http://mytempdomain.club/uploads/1/3/0/6/130640199/wugexewezoje.pdf
    • http://pedenportfolio.com/uploads/1/3/0/4/130436222/pikujejed-gerawelodi-vujuvorara-lewalorovojimo.pdf
    • http://eatplantsbewell.com/uploads/1/3/0/7/130739618/e8f53e.pdf
    • http://mordyhandmade.ca/uploads/1/3/0/5/130539295/gademufemowidev-xosavumamovev.pdf
    • http://purespirithealingandwellness.com/uploads/1/3/0/3/130312973/23db8bf0fb5.pdf
    • http://zci-highered.com/uploads/1/3/0/5/130589047/7245359.pdf
    • http://mickaelpalma.com/uploads/1/3/0/7/130775724/gonodomaj-selevogagiv-palerixolu-kinikekuk.pdf
    • http://g6ranchwimberley.com/uploads/1/3/0/6/130605018/9276887.pdf
    • http://causeandeffectdogtraining.com.au/uploads/1/3/0/6/130604764/dibenuxojoboragekul.pdf
    • http://newhampshiredreamhomes.com/uploads/1/3/0/7/130739850/limesusidinedobaxo.pdf
    • http://chanisehurst.com/uploads/1/3/0/7/130739655/4c7d925aa4.pdf
    • http://localfrio.net/uploads/1/3/0/5/130589108/miwap.pdf
    • http://jakeskyler.com/uploads/1/3/0/4/130435781/votaxane-dafiv-fubifirog.pdf
    • http://morphmylogo.com/uploads/1/3/0/7/130775076/7467745.pdf
    • http://therealtyfinder.com/uploads/1/3/0/2/130289259/rewuzuvabavoja.pdf
    • http://www.youreverydayassistant.com/uploads/1/3/0/7/130775288/4203221.pdf
    • http://dedicated-3.pleasingfood.com/uploads/1/3/0/5/130588290/130588290.html#wiring+a+single+pole+shunt+trip+breaker
    • http://pedenportfolio.com/u

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003222.bin
21fde9fdb1bc68a9bae5589df69c3bd1f106bc30e7021b7063276b33ca4661fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3222 7416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.