Malicious PDF — malware analysis report

Static analysis result for SHA-256 1475618043e9ba28…

MALICIOUS

PDF

62.5 KB Authoring application: Karbon
MD5: 7e30f53b433ce2ecc53ea879552785ce SHA-1: ee17b8af5f962a3b8d9556ef71f35683910036b0 SHA-256: 1475618043e9ba28723acee93eb3485898c19d7bd12e096c8e20f0c0e8cdc372
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a tactic to manipulate search engine results or redirect users to potentially malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output further support its malicious nature. While no scripts were explicitly extracted, the embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theclinicalfit.com/uploads/1/3/0/9/130969027/tutor_sefagobisumawem.pdf
    • http://sfiys.net/uploads/1/3/0/5/130550763/8429518.pdf
    • http://angelstouchmobileps.com/uploads/1/3/0/6/130620863/wivoduduzed-rewet.pdf
    • http://alphaomegadetailing.net/uploads/1/3/0/5/130543280/senoz.pdf
    • http://dnrepairs.com/uploads/1/3/0/7/130775441/wexogesosutedinin.pdf
    • http://miamilegalcenter.com/uploads/1/3/0/3/130313149/0a27527764.pdf
    • http://elitetestingservices.net/uploads/1/3/0/4/130483539/mixaxujim.pdf
    • http://awpcmarianna.com/uploads/1/3/0/5/130590395/magug.pdf
    • http://verycoolgiftbaskets.com/uploads/1/3/0/6/130620459/ruminunulovagi-wejok-kovugurubal-fabixovojovaref.pdf
    • http://www.saradinardomakeupartist.com/uploads/1/3/0/7/130739056/bapanupir.pdf
    • http://renewair.org/uploads/1/3/0/4/130475996/pemujimebix.pdf
    • http://atrealtrump.com/uploads/1/3/0/4/130489228/3b3b0461.pdf
    • http://michellewhyman.com/uploads/1/3/0/6/130620684/4183018.pdf
    • http://andigeloolaw.com/uploads/1/3/0/6/130620475/koluzakodana-fupiledojer.pdf
    • http://victorias-senior-1.rominastiebenphotography.com/uploads/1/3/0/6/130639853/130639853.html#aditya+hrudayam+slokam+tamil
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006533.bin
149a605e56163e27158314910ae3c30a4c22ce0d0d94be21ea23247d11c053c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6533 20624 bytes
font_01_sfnt_off00009db7.bin
264bf0666f1b1c7d6ad4a02b91877764a55a7348aaf8dc6eed95d0418e347595		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9DB7 7364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.