Malicious PDF — malware analysis report

Static analysis result for SHA-256 e23bd51eb44e7fe9…

MALICIOUS

PDF

49.6 KB Authoring application: SWFTools
MD5: 720618a26092243580251d6b8935665c SHA-1: becc97d88016ce07387fabde390e503d68ae7c1f SHA-256: e23bd51eb44e7fe9467e7c7fc02d6404ee3ac5cfc22df969f5a5c54d08af46c8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF files hosted on various domains. This behavior is indicative of a link farm or SEO poisoning attack, designed to drive traffic to potentially malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malware distribution intent. The document body itself is heavily obfuscated and does not provide direct clues to the user-facing lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fewasag.rurostelekom.ru/uploads/2020/01/28/9835964.pdf
    • https://gakegobadesumes.weebly.com/uploads/1/3/0/3/130323612/wavokupete-loralazofekefo-dulelero-maretegemete.pdf
    • http://sacredhearts.ca/uploads/1/3/0/6/130603882/9e792384.pdf
    • http://mtrageserllc.com/uploads/1/3/0/5/130551718/1abba448577.pdf
    • http://papejumike.meessays.info/uploads/2020/01/28/e2781ed.pdf
    • http://alabamafanaticon.com/uploads/1/3/0/5/130545241/fifonasipama.pdf
    • http://vsetoplivo.ru/uploads/2020/01/27/82f86bd3.pdf
    • http://joeljimenezfashion.shop/uploads/1/3/0/2/130274256/ae73773d.pdf
    • http://brainspaceclassroom.com/uploads/1/3/0/4/130488701/8986331.pdf
    • http://silverspurcamp.com/uploads/1/3/0/5/130588288/fopitikuzakomi.pdf
    • http://onestoptoolshop.shop/uploads/1/3/0/5/130544826/9803a.pdf
    • http://treeplantinghouston.com/uploads/1/3/0/4/130483509/9ce5ffaf8bff.pdf
    • http://susitixet.bp-bas.com/uploads/2020/01/28/ruwaravodiz.pdf
    • http://pensacoin.com/uploads/1/3/0/2/130271031/pivarumila.pdf
    • http://d-team.info/uploads/1/3/0/5/130539215/ecd1ee250.pdf
    • http://soz.quantum-communication.com/uploads/2020/01/28/ditej.pdf
    • http://zamapag.ecoopower.com/uploads/2020/01/27/pasijolodifura_vakilibafu.pdf
    • http://chanisehurst.com/uploads/1/3/0/2/130288661/4943552.pdf
    • http://mosap.fondgreenbros.ru/uploads/2020/01/28/ad84ef4e2f.pdf
    • http://pita.to19.icu/uploads/2020/01/27/0bbe432bc.pdf
    • http://gitu.lumiprint.ru/uploads/2020/01/28/vudopitafu.pdf
    • http://12stonesmoldcleaning.com/uploads/1/3/0/5/130540869/73203e498619997.pdf
    • http://vikokoz.karvan-group.com/uploads/2020/01/27/5994030.pdf
    • http://benebusivu.infonetacademy.tech/uploads/2020/01/28/finamixo.pdf
    • http://bejustalittlebetter.com/uploads/1/3/0/3/130379902/130379902.html#samsung+a50+4gb+ram+gsm+arena

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001886.bin
21cd4380a4e43d65176cbe9cc88a64f38323e6d03072af0435cf434a17bf92b0
pdf-font-stream PDF embedded font (sfnt) at offset 0x1886 8600 bytes
font_01_sfnt_off00007231.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04
pdf-font-stream PDF embedded font (sfnt) at offset 0x7231 2616 bytes
font_02_sfnt_off00007acc.bin
ddc6c38a5929b263b215a5b0c7aa8b1a409f146866f06980111f9f21a6232bf4
pdf-font-stream PDF embedded font (sfnt) at offset 0x7ACC 16036 bytes