PDF malware analysis — malicious · a3368e63760379fb

MALICIOUS

PDF

45.5 KB Authoring application: Nitro PDF

MD5: 725af4b85703584580f6e5175a7c4400 SHA-1: 3c61ed9d909666b984134f6cb61b3af68311952d SHA-256: a3368e63760379fbd1ab8439f55d68c9c92cf0a8917dbb1b5962db3ac150c334

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious payloads. The ClamAV heuristic 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the 'PDF_SEO_LINK_FARM' heuristic strongly indicate a phishing or malicious redirection campaign. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://unbreakablechampionship.weebly.com/uploads/1/3/0/3/130379843/mezazilam_sejidanofi_pirokekujunuzik.pdf
- http://mafibi.webreseller.ru/uploads/2020/01/29/vamedagozoko.pdf
- http://cofrefinanciero.com/uploads/1/3/0/6/130639464/mejiludabijugu_maweduliro.pdf
- http://ramblinghouseshow.com/uploads/1/3/0/4/130476048/0b4af41b9c.pdf
- http://robu.najiyagalimova.com/uploads/2020/01/28/248223.pdf
- http://cjsgarden.org/uploads/1/3/0/3/130313190/tebalev_lifowunaki.pdf
- http://azarenkosergey.com/uploads/2020/01/28/d8d20080.pdf
- http://lrg.ky/uploads/1/3/0/6/130639347/ee29d742cad6dda.pdf
- http://lawncarebenton.com/uploads/1/3/0/5/130589252/mulat.pdf
- http://wunisotixi.betterqualityreviews.com/uploads/2020/01/28/9641311.pdf
- http://moorestownlegendslax.com/uploads/1/3/0/6/130621665/1dc21.pdf
- http://northhaledontreeexperts.com/uploads/1/3/0/6/130604492/vejefavisoxe.pdf
- http://sutew.smokerate.ru/uploads/2020/01/27/55189b6142.pdf
- http://themalibubuilder.com/uploads/1/3/0/4/130476885/1112313.pdf
- https://ronojanakut.weebly.com/uploads/1/3/0/4/130436224/vuxeporiseb.pdf
- http://libertygraphicsok.com/uploads/1/3/0/4/130483354/lokada.pdf
- http://ronomusadi.rstuff.xyz/uploads/2020/01/29/9850838.pdf
- http://mikemooers.com/uploads/1/3/0/6/130621461/4253440.pdf
- http://crosleyoutdoorproducts.com/uploads/1/3/0/2/130271128/88e757.pdf
- https://monokagixajazo.weebly.com/uploads/1/3/0/6/130604625/3559833.pdf
- http://mycubbylife.com/uploads/1/3/0/4/130436058/doxogaza.pdf
- http://gemozukid.chungthanhnien.com/uploads/2020/01/28/fopidoduvoniparotev.pdf
- http://nadinelambert.com/uploads/1/3/0/4/130476143/raperovanobizominu.pdf
- http://petrapreschool.net/uploads/1/3/0/6/130621345/4632833.pdf
- https://kisekuzamuxu.weebly.com/uploads/1/3/0/3/130324420/zowuroxino.pdf
- http://doylestownbotox.com/uploads/1/3/0/6/130604737/130604737.html#ice+sheets+melting+affect

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000175f.bin` `72e4b712410c0d1cc9e534c1d2ab854326217f730d3ad2ce326d164ce541c93f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x175F	8128 bytes
`font_01_sfnt_off00006977.bin` `5d7ebd720715cd86529581f1d40cc643f68465477bd430d4be5ff736bc95f798`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6977	16268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.