Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f182e4de1c12a98…

MALICIOUS

PDF

54.1 KB Authoring application: Smallpdf Desktop
MD5: 66e7e636d5bd67b63b1aa9bbd381abea SHA-1: 38b5fbe956ec0dcfe06ad7024d7c86c262fa6c52 SHA-256: 8f182e4de1c12a988c79d5444272dd943770db7eb550e576fc7dc9181275f7a4
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicates a phishing campaign. The document body, though partially corrupted, contains references to 'Aggiornamento google chrome android' and includes multiple URLs pointing to PDF files, suggesting a lure to download malicious content disguised as a browser update. The presence of a 'download button' heuristic further supports this phishing pretext.

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adentakorea.com/uploads/1/3/0/6/130603807/lugirogurebexin.pdf
    • http://fisheyekauai.com/uploads/1/3/0/6/130620628/wogeratawol-xukexaf-makoto.pdf
    • http://monthlytoothtalk.net/uploads/1/3/0/2/130288563/8331821.pdf
    • http://ministeringwithmegan.com/uploads/1/3/0/6/130639599/130639599.html#aggiornamento+google+chrome+android

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001038.bin
2c106ac3200cf929f1215235578c1f48ac36df3499da78c26ed74e646c69467c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1038 9236 bytes
font_01_sfnt_off00006832.bin
d4a9f976c82a53c5d426bde6e7b64985b56561e2794cddce1c5a01619a76f192		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6832 16740 bytes
font_02_sfnt_off00008e09.bin
d60e2eb62e2a9765a1c86d97aa356a395f69e1f52e6372c90c7944723fa29a8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8E09 16064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.