Malicious PDF — malware analysis report

Static analysis result for SHA-256 e27a902c620bc321…

MALICIOUS

PDF

38.0 KB Authoring application: SWFTools
MD5: 4aece0351f63165c87a9af50486f3509 SHA-1: 4a0f27a58f62bdd1024005b1edc1d81b7d281958 SHA-256: e27a902c620bc321dcf01ce94200a8d7d4f9130ac79bc24692eedf8334847015
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of a link farm, with 'aralis.global' being a dominant host. No scripts were extracted, limiting the analysis of direct execution capabilities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aralis.global/uploads/1/3/0/8/130814290/512507d928f.pdf
    • http://kyoto-japan-django.club/uploads/1/3/0/5/130547024/daxuwofegedil.pdf
    • http://chippenhampositiveliving.com/uploads/1/3/0/2/130289284/3898026.pdf
    • http://dayakquest.com/uploads/1/3/0/3/130313368/wesomugizotuk.pdf
    • http://missions4jesuschrist.com/uploads/1/3/0/6/130604048/139283b9.pdf
    • http://nhlitigators.com/uploads/1/3/0/6/130603819/kidularamefaza_purofomafev_kafibatular.pdf
    • http://ingeniumschools.net/uploads/1/3/0/5/130543418/b3610912e42.pdf
    • http://azfairhousing.org/uploads/1/3/0/6/130639116/04ca7e.pdf
    • http://actorheadshotphoto.com/uploads/1/3/0/3/130313429/89ccfcbfaa412d.pdf
    • http://nimbus-realty.com/uploads/1/3/0/7/130739894/5160428.pdf
    • http://essteamlab.com/uploads/1/3/0/7/130738903/2904032.pdf
    • http://misssoutheastpageantry.us/uploads/1/3/0/2/130289467/130289467.html#introduction+email+for+new+job+example

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000325c.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x325C 1708 bytes
font_01_sfnt_off00003d58.bin
4cec2acfbbdc1e387abdb8c3a47cb1fb0f7cfdfde4f729a3686dfa13720ffc47		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D58 7964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.