Malicious PDF — malware analysis report

Static analysis result for SHA-256 af5b8f99e82cc757…

MALICIOUS

PDF

38.2 KB Authoring application: Nitro PDF
MD5: 535533b2d4284d99e0d8dab60008bdc5 SHA-1: a3b2a1b7d1cfe32e85a040409a5d21d6b8073d03 SHA-256: af5b8f99e82cc757b5f7dae861489d073a23cc848bab543afc55d435d909207b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, pointing to external PDF files. This suggests a phishing or SEO spam campaign. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent related to phishing. No scripts were extracted from this sample, limiting the analysis of direct execution capabilities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mymokshayoga.com/uploads/1/3/0/5/130545681/kozakis.pdf
    • http://slimbots.com/uploads/1/3/0/5/130550770/masopedowemoralorefi.pdf
    • http://northwestfineartstudio.com/uploads/1/3/0/7/130738758/8916625.pdf
    • http://merakihandmades.com/uploads/1/3/0/4/130491932/dumuzatu_fotugeni_gagetodazoz.pdf
    • http://nyctoursandattractionsgroup.com/uploads/1/3/0/8/130813888/f8ff68713ca80f9.pdf
    • http://occiv.com/uploads/1/3/0/5/130589275/movatitigoroson-puzamina.pdf
    • http://paradoxical-reality.net/uploads/1/3/0/5/130589199/rodos.pdf
    • http://brownestonetravel.info/uploads/1/3/0/4/130483725/wiwonozafevov.pdf
    • http://mylivgrace.com/uploads/1/3/0/5/130589410/fbfd5179163b.pdf
    • http://shawnthadawnkilldatrack.com/uploads/1/3/0/6/130640223/4498354.pdf
    • http://webmail.winterhomeschoolconference.com/uploads/1/3/0/8/130814401/5066211.pdf
    • http://mydhfastmandat.com/uploads/1/3/0/7/130776726/zuxiwok_benuwilozaj_xomapigibupozon.pdf
    • http://nihaoskiescalls.com/uploads/1/3/0/6/130639358/kiwakutedaluzefix.pdf
    • http://forgenesis.ca/uploads/1/3/0/2/130272603/8357b30adfe07.pdf
    • http://cr-routines.com/uploads/1/3/0/6/130621373/tisutebarekiwi.pdf
    • http://www.greenvalleyfloral.net/uploads/1/3/0/9/130969139/dawuzujis_dusilofe_dulasosilo.pdf
    • http://rachaelcrevier.com/uploads/1/3/0/5/130550949/5727378.pdf
    • http://taraletsgo.net/uploads/1/3/0/6/130639812/tibuxovemisa-pavowini-xutanafiralu-vijud.pdf
    • http://poppitt.org/uploads/1/3/0/2/130272648/kolubukime.pdf
    • http://rentprivatemoney.com/uploads/1/3/0/2/130287291/7384077.pdf
    • http://thunderbeams.com/uploads/1/3/0/7/130776812/3794631.pdf
    • http://tampabayplasticsurgery.net/uploads/1/3/0/6/130620902/7669773.pdf
    • http://studio-feyre.com/uploads/1/3/0/7/130739353/abdfcb06790.pdf
    • http://merrec.space/uploads/1/3/0/3/130323430/bidup-neduwotodukami-dogozubas-kijanofom.pdf
    • http://escorti-milano.com/uploads/1/3/0/9/130969592/130969592.html#a+noun+clause+can+be+used+as+a+direct+object+or+a+subject
    • http://brownestonetravel.info/uploads/1/3/0/4/13048

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031e2.bin
e2bce966c1ec08728bb1a1eb1018b1ee352cde693ee12285105f05fa418654a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31E2 7900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.