Malicious PDF — malware analysis report

Static analysis result for SHA-256 f80f3dfdd555f97e…

MALICIOUS

PDF

50.2 KB Authoring application: Nitro PDF
MD5: 5591a0ff925aa89a544ab23799b56d92 SHA-1: a8426b70323784daf8f5758f72bfe428bcf41d60 SHA-256: f80f3dfdd555f97e345eace8f5ceb43f92c6cb6913e6e16c794e9aef2d992d3c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, forming a link farm. This is indicative of SEO manipulation or a phishing lure, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tricitytaxi.net/uploads/1/3/0/2/130289569/a2fea30.pdf
    • http://oilsfortriathletes.com/uploads/1/3/0/3/130323511/punibemizumimo_famiguf.pdf
    • http://vwear.net/uploads/1/3/0/6/130621530/5382668.pdf
    • http://mail.light2germany.com/uploads/1/3/0/8/130813357/sonogebota.pdf
    • http://dentistmanalapannj.com/uploads/1/3/0/5/130541743/lojuzerivi-vopowabolewudup-meruboziloz.pdf
    • http://orumalayalamdiary.com/uploads/1/3/0/6/130639534/jexironanejaben-jazuforif-rotimurexuvipap-tumasoga.pdf
    • http://www.rowenmatthews.com/uploads/1/3/0/7/130776060/c10e50a9f849.pdf
    • http://engstrumphotography.com/uploads/1/3/0/5/130546283/gakogoga-womiwir.pdf
    • http://themrmatt.com/uploads/1/3/0/6/130604425/484516.pdf
    • http://webmail.raritanvalleybassmasters.com/uploads/1/3/0/7/130776425/metif-jijesuleje-gogiludisofi.pdf
    • http://calgarybrokerageproposal.com/uploads/1/3/0/6/130639476/6c5c56fac3e9bd8.pdf
    • http://888claim15.org/uploads/1/3/0/4/130475980/696509.pdf
    • http://korish245.ru/uploads/1/3/0/3/130324350/fac1f900c4a7cb.pdf
    • http://mikeshomepage.net/uploads/1/3/0/6/130604494/diwubikexedegur.pdf
    • http://navasotaminerals.com/uploads/1/3/0/4/130489230/zazelemugaxasag_tojumiti_kesewidipile.pdf
    • http://toolgratis.com/uploads/1/3/0/7/130775126/jekujirokatuz_lugiligiped.pdf
    • http://knottypinewoods.com/uploads/1/3/0/7/130776366/b8a35.pdf
    • http://9f62fcb300.com/uploads/1/3/0/2/130272414/vubegeterupa.pdf
    • http://thebuttkickindietitian.com/uploads/1/3/0/8/130874329/f7e63ff77c3c.pdf
    • http://distribuidoramaissaude.com/uploads/1/3/0/2/130270866/pepavig_xonafur.pdf
    • http://cleviagrandfullsite.devsite-1.com/uploads/1/3/0/2/130272296/130272296.html#canonical+correlation+analysis+%28cca%29+in+r

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000040c1.bin
c715d70b655cc84612960fb88a4e12085ad92abfa9c7e55edaa865827c7872ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x40C1 16148 bytes
font_01_sfnt_off0000559a.bin
7fec1186382f34a5155dc6c248311be11c53bb1737067c31e8ccbb863d62d846		 pdf-font-stream PDF embedded font (sfnt) at offset 0x559A 3076 bytes
font_02_sfnt_off00006353.bin
686da0dc37e1ad57f39b3d61e3e4d73fc1a7212f5c64984d2dcb003666c1b269		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6353 8240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.