Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b0e6006b002e705…

MALICIOUS

PDF

51.8 KB Authoring application: Nitro PDF
MD5: a16c8f90e5e549d5b4f6704e24d4b826 SHA-1: 90fd8b6b90bd5440085ea736f361e9f28e5dc251 SHA-256: 4b0e6006b002e7053d259f563bafad93849f6be153a7dfbffe222ece0b60e517
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link farm of 22 external PDF links, masquerading as an MBA entrance exam sample paper. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the heuristic 'PDF_SEO_LINK_FARM' strongly indicate a phishing or malicious redirection campaign. The embedded URLs likely lead to further malicious content or phishing pages.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://typebtriathlete.com/uploads/1/3/0/5/130588875/xunerugezifog.pdf
    • http://nangreypottery.com/uploads/1/3/0/6/130622024/lapekugis.pdf
    • http://vuvar.pansionatmsk.ru/uploads/2020/01/29/181500a6db3c5d.pdf
    • http://armydarkshadows.net/uploads/1/3/0/6/130620757/toregefi-jumexigixuvid-kaxagur.pdf
    • http://annamariecrowhurst.com/uploads/1/3/0/7/130739141/a05b68e3d7eb5.pdf
    • http://nantigo.com/uploads/1/3/0/7/130775543/liferanij.pdf
    • http://khaliafrazier.com/uploads/1/3/0/6/130605108/1403664.pdf
    • http://nbrgraphs.com/uploads/1/3/0/6/130604945/4375977.pdf
    • http://kbp-wichita.com/uploads/1/3/0/3/130324385/3140111.pdf
    • http://crapradio.net/uploads/1/3/0/6/130639693/tebolamuwuti_puladadumeb_widararusetati.pdf
    • http://mindcraftcoach.com/uploads/1/3/0/6/130639739/sabip.pdf
    • http://sauerlandhypotheek.nl/uploads/1/3/0/4/130489933/130489933.html#mba+entrance+exam+sample+paper+pdf

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012db.bin
b6f92950b9ac4d19a9cbae9101ecb212d8a712b3215dbf2b49a015c3eb545980		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DB 8336 bytes
font_01_sfnt_off0000655a.bin
e10a4552665f84d40558348b0a638e2837b0020cace1ffa63ea71f78df0aa7d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x655A 16284 bytes
font_02_sfnt_off00007a77.bin
236d54f3e2479d5e72da3d1be4616617e509581c3e9108e812f40a19f40d28ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A77 2228 bytes
font_03_sfnt_off00008495.bin
1f25c4c29188e72311c04078c3c1c3ba7f23f42703dc8fd83d80c0b61a912ec8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8495 7692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.