Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b68586a7bcd33ff…

MALICIOUS

PDF

36.2 KB Authoring application: Nitro PDF
MD5: 48b7df211d2d325e99e93af170399615 SHA-1: 997519a0380e922800db9a1eec63085f2d93fe5e SHA-256: 4b68586a7bcd33ffc983e0f0aee5f256ae0ae82533c126ba80d8a324e1597200
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which are likely used for SEO spam or to redirect users to phishing sites. The ClamAV detection of Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. No scripts were extracted from this sample, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mail.fireflyanimalcare.com/uploads/1/3/0/8/130874153/nolawofig.pdf
    • http://coneyislandlightstation.com/uploads/1/3/0/7/130776617/setulanuzar.pdf
    • http://suatborazan.net/uploads/1/3/0/7/130776481/9068223.pdf
    • http://www.promotionconsultores.com/uploads/1/3/0/3/130313067/2578060.pdf
    • http://readyden.com/uploads/1/3/0/5/130551191/2632111.pdf
    • http://thebigbigbucks.com/uploads/1/3/0/6/130639607/pedirojatotugewomilu.pdf
    • http://adolfo.club/uploads/1/3/0/6/130604531/belifunad_gigosiris_bufajaxivomi.pdf
    • http://www.sironaliving.net/uploads/1/3/0/4/130436402/9459680.pdf
    • http://ooredookuwait.net/uploads/1/3/0/7/130776233/307103299c3d79.pdf
    • http://www.dragondreamspirithealer.com/uploads/1/3/0/7/130739769/7f20a5c.pdf
    • http://www.churchinfo.knobnosterfcc.com/uploads/1/3/0/7/130740572/cae28c6f3eb.pdf
    • http://iconictoast.com/uploads/1/3/0/5/130550956/rixadiz.pdf
    • http://meridianworldschoollibrary.com/uploads/1/3/0/2/130272509/6732558.pdf
    • http://edgemereestate.com/uploads/1/3/0/5/130545885/130545885.html#piano+la+vie+en+rose
    • http://thebigbigbucks.com/uploads/1/3/0/6/130639607

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003373.bin
a3bd13a600367a8013b2b9e84598e8f623d6f3a05e66b7c92efdccf2703dfcd2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3373 9148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.