Malicious PDF — malware analysis report

Static analysis result for SHA-256 cef533918bed0a0c…

MALICIOUS

PDF

69.7 KB Authoring application: Nitro PDF
MD5: df2934d4dbfe5ff24e70f205ae673607 SHA-1: 77f04ddaadb97c50a550bfbe6d649c5e7ac76a4a SHA-256: cef533918bed0a0cf78784018f7cdac5426e9d251cfeac82bfa1c9d4f324b066
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified as a "PDF_SEO_LINK_FARM", suggesting a tactic to distribute malicious content or engage in SEO abuse. The ClamAV detection as "Pdf.Phishing.TtraffRobotInstall-7605656-0" further supports a phishing or malicious traffic generation intent. The presence of a visual download button reinforces the lure to click on these links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sorcerersatchel.com/uploads/1/3/0/4/130490151/limolezax-topozujuvetapas-xavigaratu.pdf
    • http://annotalegal.com/uploads/1/3/0/2/130289344/acc23c83d3ebcb.pdf
    • http://stocksbullbear.com/uploads/1/3/0/2/130272286/zutusopubopamalo.pdf
    • http://ncahrmm.com/uploads/1/3/0/3/130379653/e872963f.pdf
    • http://debragoetz.com/uploads/1/3/0/4/130483761/34b0e3b6d.pdf
    • http://wemodiv.rcway.ru/uploads/2020/01/28/3502477.pdf
    • http://zarkrifle.com/uploads/1/3/0/5/130590209/togiwugudinamupejum.pdf
    • http://ofa-ko.org/uploads/1/3/0/4/130476407/3636127.pdf
    • http://gnshs-ptsa.org/uploads/1/3/0/4/130476161/4290754.pdf
    • http://theroverchasefoundation.com/uploads/1/3/0/6/130621060/fujasot-buzuvajebox-luweke.pdf
    • http://iweargreatness.com/uploads/1/3/0/3/130379596/130379596.html#important+days+pdf+in+tamil+2019

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000166b.bin
998f06a2dfa031dfd5684e735548edc0464b3423c2f1182cc474b1dbf6196d92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166B 12464 bytes
font_01_sfnt_off0000b9fa.bin
a88a3252a732d83265545c0d7bca880eac5c53956b7c2c19aa40bc62a0bd5b2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB9FA 16492 bytes
font_02_sfnt_off0000cf92.bin
750c92fa1db5810c6de6b1040e9c0837d38486580b44de1cde3f2eb8b8040d63		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF92 6664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.