Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3f3f7e7d2016bb1…

MALICIOUS

PDF

43.3 KB Authoring application: SWFTools
MD5: 36080cf6a47fa5a96fc9307de7e2e93e SHA-1: f8a54a01c8c2388093a229856939b0dab35d71af SHA-256: e3f3f7e7d2016bb11f97039ed01d2c0f7376c22db14f904e7dae6d1d38a21880
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains, indicating a link farm strategy. This is strongly suggestive of SEO-based phishing or malware distribution campaigns. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent related to traffic redirection or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://downsideupphoto.com/uploads/1/3/0/5/130540453/2247396.pdf
    • http://www.kingsairway.net/uploads/1/3/0/7/130775791/gevuvasewafapuv.pdf
    • http://nolatesting.com/uploads/1/3/0/4/130483909/7107941.pdf
    • http://pmpromotions.net/uploads/1/3/0/5/130540874/buruzisa.pdf
    • http://www.twisted-hanger.com/uploads/1/3/0/6/130620912/fudegusa.pdf
    • http://houseofmapa.com/uploads/1/3/0/5/130590157/8138933.pdf
    • http://bodydelux.com/uploads/1/3/0/5/130539188/687445.pdf
    • http://tasticle.com/uploads/1/3/0/7/130776169/latunipi.pdf
    • http://mosnaturalhaircare.com/uploads/1/3/0/7/130775516/jotijomafoxeput.pdf
    • http://beyondbouillon.com/uploads/1/3/0/6/130603828/119b2a.pdf
    • http://amazing-documents.com/uploads/1/3/0/8/130814010/givezomavefanakajife.pdf
    • http://www.gatosolo.net/uploads/1/3/0/5/130540280/8406538.pdf
    • http://myblueprintforchange.com/uploads/1/3/0/2/130288416/2890315.pdf
    • http://pbcdac.com/uploads/1/3/0/6/130620679/xerikik.pdf
    • http://glocalive.com/uploads/1/3/0/3/130379155/gasafilog-xazemis-sefep.pdf
    • http://poliotoolkit.org/uploads/1/3/0/8/130873872/pagegubosazelol.pdf
    • http://elmiloveyou.com/uploads/1/3/0/3/130379311/9388204.pdf
    • http://www.ngbarmy.com/uploads/1/3/0/6/130620808/9230995.pdf
    • http://www.hempfulcolorado.com/uploads/1/3/0/5/130551192/pofurab.pdf
    • http://nashvillepianomovers.com/uploads/1/3/0/3/130379317/wefogujifi_tuvimonorej_nitiruvujoni_voxebenu.pdf
    • http://spencertunickbooks.com/uploads/1/3/0/2/130274371/nukadivegijebe.pdf
    • http://natalieelizabethseipert.com/uploads/1/3/0/7/130739029/genizizuvofivefoba.pdf
    • http://yiwencaiblog.com/uploads/1/3/0/2/130291485/fezivatabagas.pdf
    • http://carlosdia.com/uploads/1/3/0/8/130874473/130874473.html#abacus+hematology+analyzer

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004582.bin
4c96964e68b585d1037ce11cf0670b15934ac01486de1d16a2a60a00e637e52b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4582 8728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.