Malicious PDF — malware analysis report

Static analysis result for SHA-256 f68f2804c37be135…

MALICIOUS

PDF

32.3 KB Authoring application: Solid Converter PDF
MD5: ca7efd5214f7af8a4cfc93aed4874d20 SHA-1: c0b6240fc1537057309169b8981add41957dac98 SHA-256: f68f2804c37be135b3427b001df13c83ecf6bb0644626e9927cf390670ad39ae
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains a large number of external links, many of which point to PDF files hosted on various domains. The heuristic 'SE_BROWSER_INSTALL_LURE' indicates that the document's content likely prompts the user to install a browser extension or update. This is a common social engineering tactic used to facilitate credential theft or malware installation. The ClamAV detection further supports its malicious nature.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://innergameofapproach.com/uploads/1/3/0/6/130605344/fdf2f19eef4091b.pdf
    • http://tofubox.shop/uploads/1/3/0/5/130540033/xuvagater_lupopamikole_zojif_balugemitokinav.pdf
    • http://www.revitalizeesthetics.com/uploads/1/3/0/7/130775840/jivufituwus.pdf
    • http://mistresswidow.com/uploads/1/3/0/6/130604911/tipogatesa-fixesikiki-razewekajotej-sejidegozetama.pdf
    • http://mrsmuenks.com/uploads/1/3/0/3/130323384/6340210.pdf
    • http://ndlobmac.com/uploads/1/3/0/8/130813765/912255.pdf
    • http://vinoreservado.com/uploads/1/3/0/3/130313158/9828166.pdf
    • http://mirrorsireland.com/uploads/1/3/0/5/130541552/jaropux-baxirubosebo-gokupa-gikalovisido.pdf
    • http://miraclevalleyceylon.com/uploads/1/3/0/6/130603942/2821868.pdf
    • http://myultimatecuts.com/uploads/1/3/0/6/130621706/9549e737e.pdf
    • http://candlesmedia.com/uploads/1/3/0/4/130475959/484d0e6a4d40ce.pdf
    • http://selfindulgence.org/uploads/1/3/0/4/130476921/1666052.pdf
    • http://androoms.net/uploads/1/3/0/8/130873842/besowediro.pdf
    • http://ventonconsulting.com/uploads/1/3/0/8/130813378/f46903bf6bf.pdf
    • http://tonicbagsshoes.com/uploads/1/3/0/2/130289550/kapefomukinoreweku.pdf
    • http://theurbanclimatologist.com/uploads/1/3/0/7/130738543/jafakoz_fujolij_xosutatubaja_zawesifusukup.pdf
    • http://core-therapeutics.com/uploads/1/3/0/7/130738870/gusulejamor.pdf
    • http://mesheracapital.com/uploads/1/3/0/5/130551001/5076546.pdf
    • http://furnitureadvantage.com/uploads/1/3/0/2/130270742/6719411.pdf
    • http://74-123-76-213.mgwnet.com/uploads/1/3/0/6/130621019/130621019.html#descargar+adobe+reader+para+windows+xp+sp3+32+bits

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000210a.bin
18e66fc4f8543cc8ea611d2d95767d0187e6b8ce9aef39e83921861988acfb57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x210A 7288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.