Malicious PDF — malware analysis report

Static analysis result for SHA-256 c14b4def05763a0d…

MALICIOUS

PDF

35.3 KB Authoring application: PDF Studio
MD5: 58cc9001be35e696b898bc0941707c47 SHA-1: 8ad5d7877a9b630ba0f899a3b83a2fd9e748ef4f SHA-256: c14b4def05763a0db1569da5654fa66513818800239b7abcaa476bea57ce1c8c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a significant number of embedded external links, characteristic of a link farm designed to redirect users to potentially malicious content. The document body contains text related to PDF editing software, which may serve as a lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ekcoelearningcommons.com/uploads/1/3/0/5/130540208/xosipabaken.pdf
    • http://mydmdesign.com/uploads/1/3/0/5/130550834/1504159.pdf
    • http://retrofitmetalroofing.com/uploads/1/3/0/7/130739631/3457244.pdf
    • http://kotiidartat.site/uploads/1/3/0/4/130488669/rumupekawivu-junokonefeb-dimima-gimixaw.pdf
    • http://milablooms.com/uploads/1/3/0/4/130483509/pekopajidolapovokex.pdf
    • http://wrml.net/uploads/1/3/0/6/130621357/d89e14617b9bd.pdf
    • http://altlyf.com/uploads/1/3/0/7/130776125/4759949.pdf
    • http://countryseasonsbnb.com/uploads/1/3/0/5/130589342/275fbc4.pdf
    • http://www.eds.company/uploads/1/3/0/2/130287283/4477806.pdf
    • http://vinoreservado.com/uploads/1/3/0/3/130313103/mixuguseju.pdf
    • http://tyaxlivingthedream.com/uploads/1/3/0/6/130603772/2610540.pdf
    • http://dogma531.com/uploads/1/3/0/7/130776394/639d378113.pdf
    • http://thehavenresorts.devsite-1.com/uploads/1/3/0/7/130740142/130740142.html#foxit+pdf+editor+for+windows+7+64+bit
    • http://altlyf.c

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003214.bin
10b81490df1911b9bc65e8b1b99f37636683dcbf3fccb03860499aab9fbba1ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3214 7944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.