Malicious PDF — malware analysis report

Static analysis result for SHA-256 b57b4abcdfe5c377…

MALICIOUS

PDF

36.1 KB Authoring application: Nitro PDF
MD5: 6ab7dd0b35e86af28ccc84e982d6c1b6 SHA-1: a37a0f9c12cec9e49b076709efc52801f441c5ac SHA-256: b57b4abcdfe5c377ea159a2af2dae9e10f055d07fe861c3b9cbf1f7fbed3aee5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded URLs, indicating a link farm designed to redirect users to malicious content. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malware distribution intent. The primary attack pattern involves luring users through these links, likely to download further payloads or harvest credentials.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gojiw.janderu.xyz/uploads/2020/01/28/2239962.pdf
    • http://rav.mansbestfriendmemorial.com/uploads/2020/01/28/kirebeferotatita.pdf
    • http://firstcommonsense.com/uploads/2020/01/27/xasedabi.pdf
    • https://golirupo.weebly.com/uploads/1/3/0/4/130476378/fdaa6d761a.pdf
    • http://nexatito.s-us.ru/uploads/2020/01/27/mapoju.pdf
    • http://zigomirigu.testim.tech/uploads/2020/01/29/nopanefigawuwo-wubife.pdf
    • http://wogowejuka.uaenoon.net/uploads/2020/01/27/4424270.pdf
    • http://dipumu.thaimanohra.com/uploads/2020/01/29/5069016.pdf
    • http://pugo.chinafication.com/uploads/2020/01/27/vatagovilu-zubedemunusi-vixevopavevup.pdf
    • http://kingdomreconstruction.com/uploads/1/3/0/4/130483989/digopigut.pdf
    • http://dome.fasadurfo.ru/uploads/2020/01/28/32e30be3f4f.pdf
    • http://kuf.smokerate.ru/uploads/2020/01/27/refitepogabadop.pdf
    • http://urfacefix.com/uploads/1/3/0/4/130489072/130489072.html#plus+value+comptabilite

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001444.bin
bb194f012d772ba151204f57c2e9f1a98b2fdb339ebb3813c6887c3b21a23b59		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1444 8528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.