Malicious PDF — malware analysis report

Static analysis result for SHA-256 eaaad44a25d4ffbe…

MALICIOUS

PDF

42.0 KB Authoring application: Nitro PDF
MD5: 5577e8163b59b558b283274d90a5e22d SHA-1: 2e6223d142b7be1d12ceb6b16e434871d50ead93 SHA-256: eaaad44a25d4ffbe7645b54dcbbce6825e97885e565e689c96d6fdd988ac8814
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign aiming to redirect users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and traffic redirection nature of this file.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gettinggirlsonline.com/uploads/1/3/0/8/130814984/nexodarelekif.pdf
    • http://captcush.com/uploads/1/3/0/5/130543684/zuradarozogavulo.pdf
    • http://michaeltaylorwrites.com/uploads/1/3/0/2/130270792/04292078.pdf
    • http://www.lyra-di-orfeo.fr/uploads/1/3/0/2/130273610/ketukoropatepa-luramekujiwer-kibijuke.pdf
    • http://www.dcfchurchftbend.org/uploads/1/3/0/5/130590613/dizuroxijat.pdf
    • http://admin.freshinsights.nl/uploads/1/3/0/5/130590682/nukujipo.pdf
    • http://hostmaster.bryngwynict.co.uk/uploads/1/3/0/2/130273803/guxedanifelabunalesa.pdf
    • http://nevewinter.com/uploads/1/3/0/6/130621533/b4ce265.pdf
    • http://newlifedestination.com/uploads/1/3/0/8/130813120/203add6e656.pdf
    • http://gasparillagears.com/uploads/1/3/0/2/130291365/7871350.pdf
    • http://ns-ds.com/uploads/1/3/0/9/130969972/kemunupekobojezoban.pdf
    • http://www.kimwallis.com/uploads/1/3/0/2/130272504/1648656.pdf
    • http://finkenthallivingenvironmentclass.com/uploads/1/3/0/7/130739303/40bdb4d18.pdf
    • http://shanghaiveggies.com/uploads/1/3/0/7/130739996/lumisiwunixabo_gagowodemasorek_malawatukek.pdf
    • http://sinmaps.com/uploads/1/3/0/6/130621805/dazabowaturap.pdf
    • http://mymeemli.com/uploads/1/3/0/7/130740387/wusuweza.pdf
    • http://androidexperience.com/uploads/1/3/0/3/130379058/1506855.pdf
    • http://quebanana.com/uploads/1/3/0/5/130544072/nupawexapizalali.pdf
    • http://kaiauluconnectors.com/uploads/1/3/0/4/130488970/resowufuj.pdf
    • http://canapakm0.it/uploads/1/3/0/7/130775962/lamilenogabivijesa.pdf
    • http://safemoneyofgeorgia.com/uploads/1/3/0/6/130639062/2818206.pdf
    • http://wangluoyouxibalidaoyulecheng.br3h.com/uploads/1/3/0/7/130776535/puxiboxazuriruvu.pdf
    • http://x0877193xstreamtravel.xsideas.com/uploads/1/3/0/5/130544635/130544635.html#bartholin+duct+cyst
    • http://gettinggirlsonline.com/uploads/1/3/0/8/1308149

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004070.bin
0bf42aae28645dbb8774b60983c3337da17e8552754cb6daf262e8f4c7dad54a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4070 8688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.