Malicious PDF — malware analysis report

Static analysis result for SHA-256 f755b789ab05051f…

MALICIOUS

PDF

97.1 KB Authoring application: Nitro PDF
MD5: 5904dd5c91077e5344c9d56f01d880c6 SHA-1: dc529837a347f993660e45a57b3e5dff42395e04 SHA-256: f755b789ab05051f612dec1e9872c8df1a404845f67fde858a9ffaadc2246c5e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files, indicative of a link farm or SEO manipulation tactic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further suggests a phishing or traffic redirection intent. No scripts were extracted from this sample, but the heuristic 'PDF_SEO_LINK_FARM' strongly suggests the document's purpose is to drive traffic to a network of external sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ckmnortheast.com/uploads/1/3/0/4/130489097/745a27.pdf
    • http://www.johnburlartisprofessionalleadershipconsultant.org/uploads/1/3/0/2/130292179/1647268.pdf
    • http://www.kgwritingservices.com/uploads/1/3/0/2/130288468/2adad.pdf
    • http://mitridate.com/uploads/1/3/0/7/130776113/2322935.pdf
    • http://frnkjmz.com/uploads/1/3/0/4/130476921/mikofis.pdf
    • http://anongenescreen.com/uploads/1/3/0/4/130483869/nopunegexibotila.pdf
    • http://nuovaedilart.it/uploads/1/3/0/3/130379523/65f394408d4ca.pdf
    • http://natashanicole.ca/uploads/1/3/0/6/130620321/15dbf679cf.pdf
    • http://n2everything.com/uploads/1/3/0/4/130477110/916840.pdf
    • http://runa-ua.com/uploads/1/3/0/7/130738769/d003091228c2a35.pdf
    • http://masterofthedomains.com/uploads/1/3/0/2/130289205/vogevesuvim.pdf
    • http://fakeangels.space/uploads/1/3/0/4/130435697/lifasumedopuju.pdf
    • http://ajoyfulword.com/uploads/1/3/0/6/130622033/998230.pdf
    • http://olgausova.com/uploads/1/3/0/5/130590658/pokosutifimim-sejijanes.pdf
    • http://meridian-dcg.com/uploads/1/3/0/5/130551091/9153395.pdf
    • http://mta-sts.mail.laneforward.com/uploads/1/3/0/7/130738964/luniwox-perokiwikelibux-suminemosagimow-xojime.pdf
    • http://mail1.pnwer.org/uploads/1/3/0/7/130739332/pidogedawisow.pdf
    • http://wildywell.com/uploads/1/3/0/7/130775002/lokutof.pdf
    • http://morganvalleycandles.com/uploads/1/3/0/6/130620274/venegixokaputuvad.pdf
    • http://www.volunteerprogramindia.org/uploads/1/3/0/5/130539442/goxigenukupube.pdf
    • http://cschultzelectricalservices.com/uploads/1/3/0/2/130272600/lemaxinuve-nemuzizaja-xepeji.pdf
    • http://innovanations.com/uploads/1/3/0/7/130739328/2239297.pdf
    • http://lifenlogos.com/uploads/1/3/0/7/130775760/tojuka_xalafoguji_mivim.pdf
    • http://webdisk.jessicamiyuki.com/uploads/1/3/0/4/130478438/130478438.html#ap+dsc+2018+sgt+syllabus+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d8d.bin
efc92ed67b9caf401629c9281a58a3c8adfa08fa36be2e2937e8c59575b703ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D8D 8140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.