Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2b93fe6a28cde64…

MALICIOUS

PDF

36.9 KB Authoring application: Nitro PDF
MD5: 86a61938876a8652ae11da9700980647 SHA-1: 767998ac00c781a9c77e087b42cf26739b68e59c SHA-256: a2b93fe6a28cde64269b1c5667f4927149e43caa304a4c2cb7a6adff5b155058
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are disguised as legitimate files. The document body explicitly prompts the user to install an 'Acrobat reader for chrome plugin', which is a common social engineering lure to install malware or steal credentials. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and potential installation intent.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://springbrookaerospace.com/uploads/1/3/0/5/130543053/gesanubaxotuj_vigupaturepili_naseresi.pdf
    • http://blunderist.com/uploads/1/3/0/6/130621098/duridafenixej-mimokejifizogab-galemi-xupudo.pdf
    • http://neufeldvolk.com/uploads/1/3/0/2/130289540/tuzef.pdf
    • http://bangkokkettlebells.com/uploads/1/3/0/4/130435753/3540024.pdf
    • http://prisonlifeline.net/uploads/1/3/0/3/130323511/83b9786d.pdf
    • http://mnhomeinteriors.com/uploads/1/3/0/6/130604109/zewowenunowami.pdf
    • http://rixu.healthnotes.tech/uploads/2020/01/29/texigivuneg_gipes.pdf
    • http://zowaxuv.revendainstagram.com/uploads/2020/01/28/4082015.pdf
    • http://nw-enviro.net/uploads/1/3/0/7/130775528/7708475.pdf
    • http://themethodmeditation.com/uploads/1/3/0/3/130312972/130312972.html#acrobat+reader+for+chrome+plugin

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000120f.bin
17ea1fa511d9f49247442f9a3050d982024dc7477af418631195e7c5eb68c8a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120F 8108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.