Malicious PDF — malware analysis report

Static analysis result for SHA-256 e124a9e5570c4183…

MALICIOUS

PDF

36.3 KB Authoring application: PDFedit
MD5: 72f2affcd53637203bec2582db53a723 SHA-1: a1ac2d4506312db89b7c033cc6db467d3fb764a6 SHA-256: e124a9e5570c4183b3a5d02adf7ea1e2439d77574e03346f73b3a51b9df1d407
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a mass external link farm, with 19 links pointing to various PDF files hosted on different domains. The heuristic 'SE_BROWSER_INSTALL_LURE' indicates the document likely prompts the user to install a browser extension or update. This, combined with the numerous external links, suggests a phishing or malware distribution campaign. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://apiladesign.com/uploads/1/3/0/5/130588937/lamuz.pdf
    • http://delmontesupport.com/uploads/1/3/0/7/130739495/jobiranuzebunazixu.pdf
    • http://13conversations.org/uploads/1/3/0/5/130550834/pirudo.pdf
    • http://progenator.net/uploads/1/3/0/8/130874350/4992631.pdf
    • http://pumpkinqueenofthesanjoaquin.com/uploads/1/3/0/2/130289371/vavidisigokej.pdf
    • http://selahsoundhealing.com/uploads/1/3/0/7/130776182/muvubis.pdf
    • http://alexhammerschmidt.com/uploads/1/3/0/6/130605388/sekubexovuzi-wexizeripiba.pdf
    • http://cyberliabilitypro.com/uploads/1/3/0/6/130621786/puvizazijug.pdf
    • http://wwwceipnavasdetolosa.com/uploads/1/3/0/6/130621101/donuxelibagirut.pdf
    • http://www.itworksgirl.shop/uploads/1/3/0/7/130776895/loputesatuxop.pdf
    • http://texasfreedomcarriers.com/uploads/1/3/0/8/130813837/3062419.pdf
    • http://castroslandscapingma.com/uploads/1/3/0/4/130477915/fb86aa5655c79.pdf
    • http://thetaylorgroupinsurance.com/uploads/1/3/0/8/130813317/7228138.pdf
    • http://travel-minded.com/uploads/1/3/0/5/130538891/xazijofanew.pdf
    • http://www.fishlogs.co.uk/uploads/1/3/0/7/130738555/sogij_rupezuxodilej_buwajelezivel_lijinamuxorol.pdf
    • http://atbadvisers.com/uploads/1/3/0/4/130477414/234354.pdf
    • http://anisaalamia.com/uploads/1/3/0/6/130604257/1aeca1e2f1cb6.pdf
    • http://nashvillepianomovers.com/uploads/1/3/0/6/130603709/7af261524cedd9.pdf
    • http://miguelvaldiviezo.com/uploads/1/3/0/2/130287727/4204788.pdf
    • http://mx.stefanaarnio.com/uploads/1/3/0/3/130323510/130323510.html#chrome+translate+page+not+working

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ef7.bin
a21507e644bddf2b6477c8fc253770c10a9eb73bc094f1e5f813e868e8c14d97		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EF7 7996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.