Malicious PDF — malware analysis report

Static analysis result for SHA-256 19f0936952632e4e…

MALICIOUS

PDF

63.8 KB Authoring application: Nitro PDF
MD5: 1b5baf7e7b027e1b69259ef1de156a3f SHA-1: 85a17cf8c3b3584b84954f3aacdff9aab22aee7d SHA-256: 19f0936952632e4e97d63bc9ba271bf02b52d82b4c0f39eba42419be56cdd4e3
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF contains a mass link farm pointing to other PDF files, a common technique for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or scam classification. The document body also contains a call-to-action related to downloading a file, reinforcing the malicious intent.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mybluejeansbookkeeping.com/uploads/1/3/0/4/130490421/zekesikazexim-zejanol-tejax.pdf
    • http://epiphanrentals.com/uploads/1/3/0/7/130739024/6814824.pdf
    • http://mikefaverman.com/uploads/1/3/0/6/130621506/sasorolotakaxur_wupudulowe.pdf
    • http://tasmaniadisabilitylobby.com.au/uploads/1/3/0/4/130476462/6927039.pdf
    • http://spiritualunderstandingnetwork.com/uploads/1/3/0/7/130776200/besona.pdf
    • http://isellspy.com/uploads/1/3/0/6/130621248/2041169.pdf
    • http://mywelby.org/uploads/1/3/0/3/130312925/8066323.pdf
    • http://freestyleseniors.com/uploads/1/3/0/4/130478314/bobad.pdf
    • http://rainextentions.com/uploads/1/3/0/3/130313376/sivutorugukoruralog.pdf
    • http://canadianproperty101.com/uploads/1/3/0/8/130814907/kaved.pdf
    • http://zado.online/uploads/1/3/0/7/130776403/9bbbef017e.pdf
    • http://springvalleyvillagearborist.com/uploads/1/3/0/7/130740492/luvavizusopade_fefud.pdf
    • http://pan-education.com/uploads/1/3/0/2/130287529/6209089.pdf
    • http://baloyatees.com/uploads/1/3/0/6/130620263/9779021.pdf
    • http://youarenotaloneproject.com/uploads/1/3/0/7/130776035/rezimetorozo-zuguba-butudude-fufasu.pdf
    • http://doctorfieser.com/uploads/1/3/0/6/130605125/3188451.pdf
    • http://mommaleahsgoods.com/uploads/1/3/0/4/130435577/gonirube.pdf
    • http://lhs98.com/uploads/1/3/0/5/130590159/1005940.pdf
    • http://noahhartman.com/uploads/1/3/0/4/130488244/213d0bf9.pdf
    • http://dfpinvestments.com/uploads/1/3/0/3/130379430/690cdebe16167.pdf
    • http://insuremycompanyonline.com/uploads/1/3/0/7/130739607/bae6c784355c026.pdf
    • http://mikeajames.com/uploads/1/3/0/3/130324136/4659101.pdf
    • http://bonkerforbyram.com/uploads/1/3/0/4/130436399/d5486.pdf
    • http://voorheeswrongfuldeathlawyer.com/uploads/1/3/0/5/130589396/692e77c.pdf
    • http://monolect.com/uploads/1/3/0/6/130621458/nojusiken.pdf
    • http://45t34.slpny.com/uploads/1/3/0/5/130543087/130543087.html#gta+5+ps3+cheats+boat

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001745.bin
4ba64413a4b5f413d22a3fd6acb771604fe4f3ef30f696b52f1a6c030338bac6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1745 8828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.