Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4df833ce5b96d80…

MALICIOUS

PDF

54.2 KB Authoring application: Nitro PDF
MD5: 64d40428fbd172e21055f7c9804c2b1c SHA-1: 98189a9a298058d603ed14c5dc816121f62f2f50 SHA-256: e4df833ce5b96d80ddbc2aaac7f1b2a6666c4b198a3065c06b9f4de96a6ff6db
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection also flags this as a phishing-related sample. While no scripts were extracted, the sheer volume of links suggests a malicious intent, possibly for SEO poisoning or redirecting users to malicious content. The document body contains urgency language, further supporting a phishing or scam pretext.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://misssupremepurityqueen.com/uploads/1/3/0/5/130551427/vugazi.pdf
    • http://moneymonologues.com/uploads/1/3/0/5/130589452/6361443af6c60.pdf
    • http://buwib.inzim-tex.com/uploads/2020/01/28/pewop.pdf
    • http://moniqueyin.com/uploads/1/3/0/6/130621317/2f729ca248e8a.pdf
    • http://missprisstea.com/uploads/1/3/0/6/130604724/8666635.pdf
    • http://vegasjunkmovers.com/uploads/1/3/0/2/130289239/5806696.pdf
    • http://pameladirnberger.com/uploads/1/3/0/5/130589126/130589126.html#incident+reporting+and+investigation+policy

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000087ea.bin
d74d71e84bfd18308bd1eedd97306828f2d12ff12d0869f76c678feee1b71e14		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x87EA 18148 bytes
font_00_sfnt_off00001304.bin
15c9910aefa717b6cb21656a219d15c3acd12732d83f7b2b66f8f2742b4ac069		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1304 9424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.