Malicious PDF — malware analysis report

Static analysis result for SHA-256 a069455370adeb81…

MALICIOUS

PDF

47.2 KB Authoring application: Nitro PDF
MD5: 806229d393aa3c768debcd22f68cb258 SHA-1: bb5dd82d1253a5898c833db20d798bddf06d5d88 SHA-256: a069455370adeb81e2075d8701fc77c1fd66804abb87c4473ac37060a0728116
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further suggests a phishing or traffic redirection intent. The document body itself is heavily obfuscated and does not provide clear textual clues, but the overall structure points to a malicious link farm designed to redirect users to potentially harmful content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dolonlearningresources.com/uploads/1/3/0/2/130289335/8406f9f7e6.pdf
    • http://thedermamedic.com/uploads/1/3/0/7/130775288/90c353dcd15e.pdf
    • http://www.navycapstore.com/uploads/1/3/0/6/130604031/pagegomafe-wovivupevugedan-pamozaluwavifa-togokosir.pdf
    • http://mta-sts.evansmachineco.com/uploads/1/3/0/6/130639244/pojalo_juveka.pdf
    • http://browngreasefuel.com/uploads/1/3/0/5/130538945/zebezuduruliwe_jibawejano.pdf
    • http://aravahouse.org/uploads/1/3/0/6/130620184/9639407.pdf
    • http://www.dabguitarworks.com/uploads/1/3/0/4/130435702/d1b923aec747fb.pdf
    • http://www.celestialmochi.com/uploads/1/3/0/6/130621751/dizuzabo.pdf
    • http://www.mykitchenremodelsandiego.com/uploads/1/3/0/2/130289700/6a57f113e3c7.pdf
    • http://inmobiliariayome.com/uploads/1/3/0/5/130543684/b4bdb949d.pdf
    • http://merbeinhistoricalsociety.com.au/uploads/1/3/0/2/130270967/wemilezax.pdf
    • http://episcopalschuyler.org/uploads/1/3/0/8/130873978/27f7b.pdf
    • http://mizzoureview.com/uploads/1/3/0/4/130476496/malunirejedejolid.pdf
    • http://www.fusiondesigntech.com/uploads/1/3/0/5/130589058/8150563.pdf
    • http://teamfunseattle.net/uploads/1/3/0/6/130604630/36c58.pdf
    • http://enhancedbenefits.us/uploads/1/3/0/4/130488328/kulifix-fupurovepibore-sazix-dapufirejonuv.pdf
    • http://p8w9b6.salon225.com/uploads/1/3/0/5/130551464/130551464.html#ncert+solutions+for+class+8+maths+chapter+9+algebraic+expressions+and+identities

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003304.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3304 1388 bytes
font_01_sfnt_off00003bb5.bin
b84ffd929ab948447a954acc75af7222847cf01ed4aa11a6ebd0466dabe23ffa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3BB5 11584 bytes
font_02_sfnt_off00005cca.bin
80c69ff6804da39fd0104545785c1c4191e05f811cd86abbb0fd34dbd496854a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CCA 7796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.