Malicious PDF — malware analysis report

Static analysis result for SHA-256 48a73bd93d61dc6d…

MALICIOUS

PDF

107.9 KB Authoring application: Nitro PDF
MD5: 5feb2cba89b187a896e7cf6efd3978e7 SHA-1: 78d50bdfb1f9ae6779523b565b9ea732ed4a58b6 SHA-256: 48a73bd93d61dc6d58311d6092ccc33998961e496e84a071b30985043e47a5de
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various external domains. This technique is commonly used for phishing or to distribute further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and traffic redirection nature of this file. No scripts were extracted, but the embedded URLs are the primary indicators of malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://securevisionmediasolutions.com/uploads/1/3/0/5/130590051/f22cab7c8e.pdf
    • http://mountainviewmentalhealth.com/uploads/1/3/0/5/130545636/pejafiseg-bugiso-fumazim.pdf
    • http://mindfullovematchmaking.com/uploads/1/3/0/2/130287895/xovekenif.pdf
    • http://arthurcountywolves.org/uploads/1/3/0/5/130589070/xogolaguwupavuvajuru.pdf
    • http://lesetoiles-paris.com/uploads/1/3/0/6/130604517/b57826d0a0c.pdf
    • http://mohousing.weebly.com/uploads/1/3/0/4/130435721/9341322.pdf
    • http://nipmucprincipal.com/uploads/1/3/0/6/130621719/kalafipeniwobu-burifulin.pdf
    • http://mrmacbiblebook2.com/uploads/1/3/0/7/130739601/130739601.html#abrus+precatorius+seedling

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00015c3f.bin
872b8bfcd209b59d6f4bd9d637894a700048190cb2ac41a67266ac7b4f6ce5bb		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15C3F 18960 bytes
font_00_sfnt_off00001367.bin
4afe5780228f981c9ab39a501d80b22c28c8d14b45d74da2104ac9824a3656b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1367 9220 bytes
font_01_sfnt_off0000ce92.bin
408d393d9b036634cce7bac864f95175510e6fbdcd4478333c85a85464068de1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCE92 2368 bytes
font_02_sfnt_off0000dc60.bin
074ad8d567e1ac27e500f0f48f2394782115b1910029ec6b483a47e8d9a17a41		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC60 26848 bytes
font_03_sfnt_off000128cc.bin
bcee20efe74bdd6bd4317674fb091117af9030110dcc162637b068fabc8f6a53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128CC 18528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.