Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfb40952796f7b02…

MALICIOUS

PDF

38.4 KB Authoring application: SWFTools
MD5: 67ef33fed3d408ca20d0a97a0897f860 SHA-1: 7c93b2fbc80153c0471bb880c465154fdaa97d54 SHA-256: bfb40952796f7b02248a8470028a84411e9b8f32f56c721d48343920f87e1ee1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample, limiting the ability to determine specific execution chains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://curatingarchitecture.com/uploads/1/3/0/5/130539238/e1a58b2ae6a3359.pdf
    • http://kunalsen.org.uk/uploads/1/3/0/4/130488316/sawebakaxes-pamabuwobuf.pdf
    • http://brexitpartychichester.co.uk/uploads/1/3/0/5/130539825/e9a1e88b92.pdf
    • http://acdavisbass.com/uploads/1/3/0/2/130289296/zepisuwesunef-zuvowesase-mofitareniv.pdf
    • http://sydneyvolunteers.com/uploads/1/3/0/6/130603928/rubaboroj.pdf
    • http://bobodigitalmarketing.com/uploads/1/3/0/4/130488294/6667743.pdf
    • http://detroitfitclub.com/uploads/1/3/0/8/130814225/vaporiv-kepabapapof.pdf
    • http://yourself-storage-units.com/uploads/1/3/0/2/130273814/vokix-jadawari-lupudiruk.pdf
    • http://mitamasushi.com/uploads/1/3/0/5/130544131/figifakoxawekag.pdf
    • http://newhopeimageconsulting.org/uploads/1/3/0/7/130739028/f3cdaae07a2535.pdf
    • http://conciergeserviceofboston.com/uploads/1/3/0/6/130605306/6970839.pdf
    • http://parentsshopusa.com/uploads/1/3/0/2/130289235/2873003.pdf
    • http://jtaginterface.net/uploads/1/3/0/7/130740598/09e0d.pdf
    • http://lunchpong.club/uploads/1/3/0/4/130489371/4120443.pdf
    • http://lucette-bijoux.fr/uploads/1/3/0/5/130543877/6371242.pdf
    • http://newyorkcarpettile.com/uploads/1/3/0/7/130739026/111172cc8.pdf
    • http://subaccounting.com/uploads/1/3/0/3/130323952/sadazimagibulituxe.pdf
    • http://adam-ritchling-s-1.rominastiebenphotography.com/uploads/1/3/0/7/130739311/130739311.html#treat+std+antibiotic
    • http://kunalsen.org.uk/uploads/1/3/0/4/130488316/sawebakaxes-p

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000036fc.bin
e3e0da3bdc5418d93ead195578a13d8d0b976cccd01b29909bc38b5cf8449207		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36FC 8828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.