Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f173233670acc0d…

MALICIOUS

PDF

38.2 KB Authoring application: Nitro PDF
MD5: ecda57abd5f7f98cfa6da16a14fd5c7a SHA-1: 2dcaf300024ceb9be34156db1aeb6be4fd4cb634 SHA-256: 3f173233670acc0d9b1396c4e7d29f0c2eae27d94abc37be0365f6f795b1dd2f
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file is identified as malicious by ClamAV with the signature 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a large number of embedded external links, suggesting a link farm designed to redirect users to malicious content. The document body, though partially corrupted, contains language related to financial accounting past papers, indicating a lure to entice users to click on the malicious links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kaynakakademisi.com/uploads/1/3/0/6/130621484/7845335.pdf
    • http://naztecsolutions.com/uploads/1/3/0/5/130545429/1c30c.pdf
    • http://mywhiteprivilege.org/uploads/1/3/0/7/130775384/winovurerin.pdf
    • http://canepaahclp.com/uploads/1/3/0/3/130323892/6398598.pdf
    • http://capellandecampo.com/uploads/1/3/0/6/130620402/9674519.pdf
    • http://villascotti.com/uploads/1/3/0/6/130604091/felugal.pdf
    • http://stephenrosinski.com/uploads/1/3/0/4/130483963/zibutagepidozu_fidalelabuwevo.pdf
    • http://attorneyfloridaprobate.net/uploads/1/3/0/7/130739616/kunogekarugakonewu.pdf
    • http://vpokerfriends.com/uploads/1/3/0/4/130483514/4305196.pdf
    • http://eliteculinarychef.com/uploads/1/3/0/6/130604585/nuxapa_fetabikakoza.pdf
    • http://icrm2019.org/uploads/1/3/0/5/130589231/sinupaxuvodex-zenexoviwur-kiwejibapukitup-fukiropep.pdf
    • http://lavishcb.com/uploads/1/3/0/5/130545573/xinivu_rovab.pdf
    • http://michellerodesinteriors.com/uploads/1/3/0/6/130621327/1175161.pdf
    • http://thetransformationinprogress.online/uploads/1/3/0/7/130739936/voketa_kojedojut_tefitekinuwa_vesulomofug.pdf
    • http://mygoodlife.solutions/uploads/1/3/0/2/130289662/f3138231b71.pdf
    • http://simplymagicaljewelry.com/uploads/1/3/0/5/130538902/motudiwutani_rorog_nowuwon_bilaranepanevup.pdf
    • http://shanebrelesky.com/uploads/1/3/0/7/130775870/8cf2dd725e5c0f.pdf
    • http://alexparkinson.org/uploads/1/3/0/4/130476145/6612563.pdf
    • http://avedaluzern.com/uploads/1/3/0/6/130622051/6965533.pdf
    • http://cakebyjake.com/uploads/1/3/0/4/130490245/rimul.pdf
    • http://skintightbody.com/uploads/1/3/0/6/130604375/c6fcbfa6f7cf88c.pdf
    • http://vesselhouse.co/uploads/1/3/0/2/130291649/kulaze.pdf
    • http://reconcileaustraliaparty.org/uploads/1/3/0/7/130739419/a01583e0c.pdf
    • http://kelseyandmichael.rominastiebenphotography.com/uploads/1/3/0/6/130621850/130621850.html#financial+accounting+n4+past+papers
    • http://villascott

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030c1.bin
5621bdec0af6264e1970d1580b58caee70fc63cce0c140832ed02d4af51da70a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30C1 8520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.