Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0d4c00e45e7349e…

MALICIOUS

PDF

50.2 KB Authoring application: pstoedit
MD5: 5f63900bf4f3cd9466ccbc1de2dc0533 SHA-1: 30df6e8cc56ef3f6d555e8d6e07ce204422b42aa SHA-256: b0d4c00e45e7349e8fc84a78e1faa202ec7a605233983baa6e984aad3b0dc9b5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a coordinated effort to distribute content or redirect users. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection motive. The document body contains garbled text mixed with URLs, reinforcing the malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://baraspektrum.com/uploads/1/3/0/4/130476130/8917052.pdf
    • http://mylesateliersdenine.com/uploads/1/3/0/4/130435753/2649acc854348.pdf
    • http://chinesemb.weebly.com/uploads/1/3/0/4/130477945/b8b86.pdf
    • http://ctkyakima.com/uploads/1/3/0/6/130639889/jakijiguwerokitizaxo.pdf
    • http://ivyensemble.com/uploads/1/3/0/7/130738794/duwalefabutemakefib.pdf
    • http://djmichaelsimon.com/uploads/1/3/0/5/130543256/4297619.pdf
    • http://mountainandocean.org/uploads/1/3/0/5/130550920/fogapobeluwibif.pdf
    • http://abusch.weebly.com/uploads/1/3/0/4/130483980/2475492.pdf
    • http://daffodil-11.org/uploads/1/3/0/7/130775634/a8fe00b1.pdf
    • http://clucktruckportland.com/uploads/1/3/0/2/130287291/130287291.html#multi+objective+optimization+genetic+algorithm+python

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012a8.bin
2f2011c9820e2472dd2fd1f51d240ed586eb4f63ee9623365bb98d537e5497f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A8 10260 bytes
font_01_sfnt_off00008566.bin
1fb84ba694783cd5ced5bd1569b0aaa99f62d274b7a4830ae9488bd86b9d67c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8566 3416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.