Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6c2c51a6b279fd7…

MALICIOUS

PDF

36.6 KB Authoring application: SWFTools
MD5: 38e517119b81be771a3ad46374318c7a SHA-1: a45555972a141f5f205a4f001d2046d60cf08301 SHA-256: f6c2c51a6b279fd7fc23271ba1622b75bce72be1ff2d2ccceae3e91baa3386d0
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a mass external link farm, with 31 links pointing to other PDFs hosted on various domains. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of a visual download button lure suggest a phishing or malware distribution attempt. The embedded URLs likely lead to malicious content or further stages of an attack.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aestheticsplus.club/uploads/1/3/0/5/130588574/mekeviwaju_fojuker.pdf
    • http://curtisneuman.com/uploads/1/3/0/6/130604878/5493063.pdf
    • http://deafphonics.com/uploads/1/3/0/4/130476112/543305.pdf
    • http://treeoflifecg.com/uploads/1/3/0/5/130588542/252118.pdf
    • http://michaeloharagarcia.com/uploads/1/3/0/5/130588518/afb697c4d87a5d.pdf
    • http://johnlalla.com/uploads/1/3/0/4/130489367/8002289.pdf
    • http://phenioxengum.com/uploads/1/3/0/8/130813705/zinekow-faduzusib-notalakevinudu-vexonuxodube.pdf
    • http://parleyyouthfc.co.uk/uploads/1/3/0/4/130488539/julizefe-vetetizesubufu-jikuronasugofos-sotemaxowanag.pdf
    • http://newearthwarrior.org/uploads/1/3/0/2/130287242/1983972.pdf
    • http://beingsemprendedores.com/uploads/1/3/0/4/130435589/8377345.pdf
    • http://www.ferrumfratres.com/uploads/1/3/0/4/130483552/5324a8d.pdf
    • http://rockcliffetennis.ca/uploads/1/3/0/7/130775513/mikusagawip.pdf
    • http://chuckwilkins.com/uploads/1/3/0/7/130776445/a411795bb7552.pdf
    • http://vintagevancouvan.com/uploads/1/3/0/5/130590195/duvomuso-maxupafurawepe-sadagiretip.pdf
    • http://aveh.com/uploads/1/3/0/8/130814858/fekutekexoxunazutut.pdf
    • http://thekookas.com/uploads/1/3/0/9/130969891/67c50771b60491b.pdf
    • http://naturetherapycic.com/uploads/1/3/0/5/130588319/36337fd70.pdf
    • http://smoothtransitionservices.com/uploads/1/3/0/7/130776754/bagemozajerura.pdf
    • http://sanfranciscopeacetreaty.org/uploads/1/3/0/6/130639143/130639143.html#adobe+after+effects+cs6+logo+animation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fc7.bin
cf9beb7b5dbeccbea3258ec7850bda4588d4f11ca89384433d81e8d31a34dfe0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FC7 8408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.