Malicious PDF — malware analysis report

Static analysis result for SHA-256 da6715c2a631fd13…

MALICIOUS

PDF

42.9 KB Authoring application: Nitro PDF
MD5: 61877bac952290a71d216554369f5835 SHA-1: f4cbf02071fab271653d18b5666d698ad8cb33de SHA-256: da6715c2a631fd13895426569c8c6dffe6c6c46e37e06112758da6a28f9db451
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique commonly used for SEO poisoning or phishing lures. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample, but the heuristic 'PDF_SEO_LINK_FARM' indicates the primary malicious function is to redirect users to external malicious content via the numerous links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://srdasaulas.com/uploads/1/3/0/5/130588493/kibejelojejib.pdf
    • http://newchoicemusic.com/uploads/1/3/0/7/130740054/6101763.pdf
    • http://www.gamkenya.org/uploads/1/3/0/8/130874088/tusadidu-poxogijozotizi-wizewepuxaritib.pdf
    • http://www.mainhealthsolutions.com/uploads/1/3/0/5/130551461/wepikovugisu.pdf
    • http://fromcolorado.com/uploads/1/3/0/7/130739032/4500851.pdf
    • http://dnborders.com/uploads/1/3/0/3/130324136/3385049.pdf
    • http://nariknektalov.com/uploads/1/3/0/2/130270745/50ba4393a141ba.pdf
    • http://legendarypowerrangers.com/uploads/1/3/0/3/130323493/804e1c8.pdf
    • http://vetpoint.us/uploads/1/3/0/5/130588858/zepipizuzafizozug.pdf
    • http://innovateacceleratecreate.com/uploads/1/3/0/7/130740051/xitiguzawari-buwegut-lazimenos-kazadidafuturi.pdf
    • http://pridetoprison.com/uploads/1/3/0/6/130639147/fajixe-gaxetuni.pdf
    • http://stavangerfitness.com/uploads/1/3/0/6/130603959/665341.pdf
    • http://24baltimore.com/uploads/1/3/0/3/130313002/73ab43.pdf
    • http://callumworsnop.com/uploads/1/3/0/4/130483847/f6aefe91dd.pdf
    • http://billkageyspeaks.com/uploads/1/3/0/4/130476069/pires.pdf
    • http://thepurposefulmama.com/uploads/1/3/0/4/130435943/079130f52d.pdf
    • http://www.championsworship.org/uploads/1/3/0/2/130291579/8000754.pdf
    • http://www.maluoeco.com/uploads/1/3/0/6/130621312/zojoped-xevofafase-wifot.pdf
    • http://repwavets.org/uploads/1/3/0/6/130605390/newepudukes.pdf
    • http://thebigeauction.com/uploads/1/3/0/8/130813732/6d752f4c6007b7.pdf
    • http://bettergaragestorage.com/uploads/1/3/0/4/130491513/zilinasej-zasevolo-telodomilo-vosevuro.pdf
    • http://beverly-curry.pleasingfood.com/uploads/1/3/0/4/130488833/130488833.html#schindler%27s+list+piano+sheet+music+free+pdf
    • http://www.mainhe

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000330b.bin
b3f32e4f7324097e74bf023697161ab719269b2ee11e9b3f98448e62de782052		 pdf-font-stream PDF embedded font (sfnt) at offset 0x330B 4820 bytes
font_01_sfnt_off00004575.bin
6f7b504ec8e6201bb320e09b20b0a378714de9d7c9b97517f1ecddc0f48b48e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4575 9204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.