Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c29efd4f36d83fd…

MALICIOUS

PDF

47.5 KB Authoring application: Karbon
MD5: 6c9027747cf0786574e54172b59791e3 SHA-1: 7e671c03063349cc2fd37ab2249e48aad773ffeb SHA-256: 0c29efd4f36d83fdfc595be91f1855bb5a42bf368aca1abe5fa31feefe84bf54
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. While no scripts were explicitly extracted, the embedded links themselves serve as the primary indicators of compromise and the likely attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lafabriquededessins.com/uploads/1/3/0/6/130639413/4203439.pdf
    • http://thefixatedbrand.com/uploads/1/3/0/6/130621304/bawinopixete_zotibudo.pdf
    • http://www.wisdomrecoverycounseling.com/uploads/1/3/0/3/130313044/lofakojeditu.pdf
    • http://shuttcv.com/uploads/1/3/0/2/130272548/nozezenogu-gezot.pdf
    • http://havanamoments.com/uploads/1/3/0/5/130588430/6786990.pdf
    • http://mail.chocolate-club.ch/uploads/1/3/0/7/130776043/7750f6210ca.pdf
    • http://bestlimoservicelosangeles.net/uploads/1/3/0/5/130541662/1520994.pdf
    • http://www.chandlerpondoutfitters.net/uploads/1/3/0/8/130813769/pivozabujopo-bexati-bogefesun-petaf.pdf
    • http://neubrow.net/uploads/1/3/0/5/130539097/katotivod.pdf
    • http://www.pomeroywv.com/uploads/1/3/0/6/130621277/2474ff4a.pdf
    • http://elkbuskencuentra.com/uploads/1/3/0/5/130540172/583938.pdf
    • http://memoriesinsoap.com/uploads/1/3/0/5/130539492/nezofazewoniguralof.pdf
    • http://pawsitively-groovy.net/uploads/1/3/0/2/130288775/2507676.pdf
    • http://sermid.com/uploads/1/3/0/9/130969118/c6fd3900440b.pdf
    • http://mexiitem.com/uploads/1/3/0/6/130604366/fuxemupesibol.pdf
    • http://countryseasonsbnb.com/uploads/1/3/0/7/130776895/bujesedujexi.pdf
    • http://turnberrypress.com/uploads/1/3/0/4/130488829/5779992.pdf
    • http://www.paranormalworldofgsreynolds.com/uploads/1/3/0/6/130603889/xelunubuzunu.pdf
    • http://gestionwebfarmacia.com/uploads/1/3/0/6/130604502/zimaxajituvewot_lozekogozo_bowevavugafada_xifoji.pdf
    • http://adamsinterplanetary.com/uploads/1/3/0/3/130323632/lefiluvovo.pdf
    • http://plancul-lehavre.net/uploads/1/3/0/4/130489841/8619150.pdf
    • http://mail.shannonbrownactor.com/uploads/1/3/0/7/130739368/fd177c13.pdf
    • http://sta-66-99-58-208.ladse.org/uploads/1/3/0/2/130272234/130272234.html#balancing+equations+worksheet+part+2+answer+key

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000efe.bin
b090cdb1cb133b4034ec79c5c534efa98d6d17d2f432cc151c3a8ed33e7c23fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFE 8352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.