Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3d0a8d9ec2d3739…

MALICIOUS

PDF

78.6 KB Authoring application: PDF Studio
MD5: 7298569fd85c4dae6250e8447fc870b5 SHA-1: 3093d7eedab7c833d10cc588b0a0815656388916 SHA-256: b3d0a8d9ec2d3739f77777a5b7af342128165d3f956b8358e7fd956df0787b29
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified as a link farm, designed to direct users to download other PDF files. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious download intent. The embedded URLs are the primary indicators of this malicious activity.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://goodkarmabaskets.com/uploads/1/3/0/5/130588393/65d24ac.pdf
    • http://prometheanconcepts.net/uploads/1/3/0/2/130271158/113717.pdf
    • http://chrisdiniaudio.com/uploads/1/3/0/5/130588532/3798115.pdf
    • http://www.kohanafarms.com/uploads/1/3/0/6/130620728/1341027.pdf
    • http://michelleleblancshortstories.com/uploads/1/3/0/3/130313093/3280413.pdf
    • http://pergerusstuudio.com/uploads/1/3/0/6/130604419/gakalegiberavu.pdf
    • http://unforgettablepeople.org/uploads/1/3/0/2/130271232/bewif.pdf
    • http://my-life-juice.net/uploads/1/3/0/7/130738946/fojidiz.pdf
    • http://mail.rechargedmiracles.nl/uploads/1/3/0/3/130313105/5a69e90f019.pdf
    • http://www.vintagerosewomensshelter.com/uploads/1/3/0/9/130969731/potakapimutapoxugo.pdf
    • http://joinsuperiorcarriers.com/uploads/1/3/0/5/130539009/73c9897e4.pdf
    • http://pooleyslaw.co.uk/uploads/1/3/0/5/130590208/bifotutobenomo-fapozumopogi.pdf
    • http://thedogbedco.com/uploads/1/3/0/4/130436094/zujifer.pdf
    • http://pagangarden.com/uploads/1/3/0/7/130776007/0d7d1a5b5eea25.pdf
    • http://tasmaniadisabilitylobby.com.au/uploads/1/3/0/7/130739472/rologamawewevo.pdf
    • http://initnowmix.com/uploads/1/3/0/4/130436299/c488887d4bab.pdf
    • http://starstrings.com/uploads/1/3/0/5/130551391/mikelixira.pdf
    • http://fairytalesandwar.net/uploads/1/3/0/2/130291478/sokor-domesubaga-wujofuwojuduw-xowamibiziwiza.pdf
    • http://bitcoincomichandbook.com/uploads/1/3/0/6/130621846/1975941.pdf
    • http://millicentelainewilliams.com/uploads/1/3/0/2/130270985/8306184.pdf
    • http://brockmillerbasketball.com/uploads/1/3/0/5/130589402/c08c1d27f.pdf
    • http://wisconsinlimousin.org/uploads/1/3/0/6/130604791/62912282612243.pdf
    • http://anjahartley.com/uploads/1/3/0/5/130540788/7493199.pdf
    • http://edgelandscapeandmaintenance.com/uploads/1/3/0/4/130477245/130477245.html#10th+new+syllabus+maths+book+2019+pdf+download
    • http://anjahartley.com

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000188c.bin
78b941ced784e86fed2a3251cfc5c3c4cc32d732c38551de690107fb593148d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x188C 7744 bytes
font_01_sfnt_off0000b6a3.bin
eda351cfcac6d3501bf0d4dc0407898291a72a9fdf1bedfc8289439516a72fc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB6A3 18344 bytes
font_02_sfnt_off0000e582.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE582 16036 bytes
font_03_sfnt_off0000f977.bin
2950d87d769d79d0d16faf16dcd761b2c0673d4bd237e761afb1007449cc6e80		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF977 1852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.