Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5bd18a2a7cb3c3e…

MALICIOUS

PDF

54.7 KB Authoring application: SWFTools
MD5: 7e8d41c38edfb71109162b26b9208be8 SHA-1: efb55395f972f0533591d06388db896d08386619 SHA-256: b5bd18a2a7cb3c3ec7cad458b14f1732330605cf6ece9199c2b51fc2b6c71c80
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded external links, a technique commonly used for SEO poisoning or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample, and the document body content is heavily obfuscated and does not provide direct clues to the user-facing lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aminasboutique.com/uploads/1/3/0/6/130639285/b9a92ecd96.pdf
    • http://www.jennifersebring.com/uploads/1/3/0/3/130313702/4934502.pdf
    • http://savannahceramics.com/uploads/1/3/0/7/130775080/vimixomegeboje.pdf
    • http://norcal-cre.com/uploads/1/3/0/7/130775446/c1160c5e86.pdf
    • http://bluecrabkeyflorida.com/uploads/1/3/0/2/130270924/fbe0ece63d3.pdf
    • http://888claim15.org/uploads/1/3/0/7/130775997/2555585.pdf
    • http://www.spot-the-dog.info/uploads/1/3/0/5/130550743/af72756674.pdf
    • http://hostmaster.collcollective.com/uploads/1/3/0/4/130435544/kuxufaxorikewe_gubazu.pdf
    • http://caraneled.com/uploads/1/3/0/7/130775245/didizesobi.pdf
    • http://flyfish-ng.com/uploads/1/3/0/5/130588187/976704829cd.pdf
    • http://shootingrobots.com/uploads/1/3/0/6/130639284/zisakumanidif.pdf
    • http://allpropavers.com/uploads/1/3/0/4/130483783/34991.pdf
    • http://www.butterflykissesaholisticapproach.com/uploads/1/3/0/7/130739648/pejefalesasevekos.pdf
    • http://kohlsfoamsystemsmn.com/uploads/1/3/0/6/130639223/dawumovalalizolodi.pdf
    • http://newbeginningsinvestorsllc.com/uploads/1/3/0/6/130604152/4766608.pdf
    • http://www.inspiringwordsmiths.com/uploads/1/3/0/4/130476505/f6231b6.pdf
    • http://calmongoods.com/uploads/1/3/0/5/130538817/wadekes-wexifap-roruj.pdf
    • http://myraysoflight.com/uploads/1/3/0/4/130488172/putuk_sokiwoxuto_lalobenixafinid.pdf
    • http://myoutdoorvisions.com/uploads/1/3/0/4/130476586/bumolumiloju-sebujufut-difuxawuno-zebujuk.pdf
    • http://octoflow.io/uploads/1/3/0/2/130289294/zopefaxewixopumum.pdf
    • http://this-is-how-we-dance.com/uploads/1/3/0/7/130740429/f602e1410e387d.pdf
    • http://umm.rowlisonart.com/uploads/1/3/0/5/130542934/130542934.html#pregnancy+induced+hypertension+medical+definition

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010b0.bin
0b9fa1384a2eea9ab79c918bee87c7c629efaa993b9c5754981749baad7cb3c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B0 9848 bytes
font_01_sfnt_off00008b8d.bin
1a31ae148aa4af7763392fe954e924425a92485837aa085ee7fbb165703794ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B8D 2636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.