Malicious PDF — malware analysis report

Static analysis result for SHA-256 d79b32f07d44ab04…

MALICIOUS

PDF

45.7 KB Authoring application: SWFTools
MD5: 44f7d8f34043fdaba01dda77b533c3cb SHA-1: 963077bc90c9e367b95af49a8d64009ebb8edf4d SHA-256: d79b32f07d44ab044000d993ea11671d9f1ba31d4423501fb68f108d1e8cf8ff
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files across numerous domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection also flags it as phishing-related. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or execution methods.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mysticgardentw.com/uploads/1/3/0/6/130603782/f9d3b3383.pdf
    • http://gow.turizmtlt.ru/uploads/2020/01/28/luzabeda.pdf
    • http://cartonone.com/uploads/1/3/0/2/130270924/zurizijar.pdf
    • https://putajuniponi.weebly.com/uploads/1/3/0/5/130539658/9309916.pdf
    • http://rolandandcaroline.com/uploads/1/3/0/4/130475964/4265177.pdf
    • http://zewo.dateurbate.club/uploads/2020/01/29/909badafe2b.pdf
    • http://ruwonup.rurostelekomk.ru/uploads/2020/01/27/wudubo.pdf
    • http://100wwclickingcounty.org/uploads/1/3/0/2/130287847/lofitamunivinivi.pdf
    • http://lidew.iamhasan.com/uploads/2020/01/27/3597033.pdf
    • http://jowujekija.agicole-acces.com/uploads/2020/01/27/buxinuweti.pdf
    • https://varobefixuwatab.weebly.com/uploads/1/3/0/4/130435670/pafibinotugos_saguv.pdf
    • http://kibedu.aroxj.info/uploads/2020/01/28/79ad13b9a368e.pdf
    • http://detourtowonderland.com/uploads/1/3/0/3/130313427/4542969.pdf
    • http://gixowuned.gk-absolutstroy.ru/uploads/2020/01/27/nixip.pdf
    • http://sedusije.hopifai.info/uploads/2020/01/28/lisoruwutitizukalof.pdf
    • http://foko.emaxb.com/uploads/2020/01/28/8474998.pdf
    • http://zozavudiw.rennessans.com/uploads/2020/01/28/tifibumit.pdf
    • http://masterpechi.ru/uploads/2020/01/28/jofemafux.pdf
    • http://rabijaje.onlyoil.ru/uploads/2020/01/28/sitoxelusa.pdf
    • http://theinnonsilverlake.com/uploads/1/3/0/5/130590637/fezemiponix_xiriwupes_valaju.pdf
    • https://volepogopomara.weebly.com/uploads/1/3/0/4/130489536/a836faa2a.pdf
    • http://vuzoke.rttelekom.info/uploads/2020/01/28/4062199.pdf
    • http://lovewarrioryogaschool.com/uploads/1/3/0/5/130539225/130539225.html#jesus+calling+august+29

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000162d.bin
cb40935ccffd0077e372d44796c954328333610bdd0091f18c1dbaffa8ce7c0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x162D 7892 bytes
font_01_sfnt_off0000629a.bin
fac38433125b026a93ccf7d28d93a1c45c6e5eb06370aed4cdb2a5f713cb8396		 pdf-font-stream PDF embedded font (sfnt) at offset 0x629A 13116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.