Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b86f9e8f44e24ea…

MALICIOUS

PDF

38.3 KB Authoring application: Karbon
MD5: 5d79b0ca337855988ad89f161d3c4ec0 SHA-1: e64356b598f462befea7567ff4d6dedf6c335b89 SHA-256: 1b86f9e8f44e24ea79e7efb16d034c51e00a129f3041edb617de1baf1fd40693
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a significant number of embedded external links, indicative of a link farm designed to redirect users to malicious sites. The document body contains garbled text and some of the URLs, suggesting a phishing or malware distribution lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://japan-cosmo.ru/uploads/2020/01/27/0ca21f5917a0.pdf
    • http://raberuni.denem3131.com/uploads/2020/01/28/fitosu.pdf
    • http://xeuns.ru/uploads/2020/01/29/nozozu-sefogepib-vefoxapaxula.pdf
    • http://acimgejournalist.weebly.com/uploads/1/3/0/6/130620890/lomutiso_gavinutinixaxa_bebuvowo_tarud.pdf
    • http://yaremkospt.com/uploads/1/3/0/6/130621475/5ad9ce529269803.pdf
    • http://nealybirthandlactation.com/uploads/1/3/0/6/130605421/fularuselogofojeb.pdf
    • http://dasusa.tobe-ok.ru/uploads/2020/01/28/7840077.pdf
    • http://fuw.autogost.com/uploads/2020/01/28/43211.pdf
    • https://xumejefov.weebly.com/uploads/1/3/0/3/130313555/nuwulafu-pijomudefaji.pdf
    • http://tuzog.goroddetstva33.com/uploads/2020/01/29/b942a565.pdf
    • https://sonufavorunex.weebly.com/uploads/1/3/0/6/130604254/bca0a8dc80e93a3.pdf
    • https://lubukejizix.weebly.com/uploads/1/3/0/5/130590082/dorogid-jebidabimulurud-wafow.pdf
    • http://rtaylorbusinessadvisor.com/uploads/1/3/0/6/130621206/42e3154.pdf
    • http://tobesport.ru/uploads/2020/01/28/piguriw-puwafodadipemo.pdf
    • https://sodoxute.weebly.com/uploads/1/3/0/4/130483847/7169334.pdf
    • http://jozibedem.friendlylazur.com/uploads/2020/01/28/jijumadazasagiwemupe.pdf
    • http://madewithlovebydanielle.com/uploads/1/3/0/6/130604748/e1e8fb.pdf
    • http://shawsautodetail.com/uploads/1/3/0/2/130273740/d82497c.pdf
    • http://rakube.sochi-ses.ru/uploads/2020/01/28/zuvofutadogetatumido.pdf
    • http://bebeke.ecobike-shop.ru/uploads/2020/01/29/kusovenugo.pdf
    • http://laf.audiostart32.icu/uploads/2020/01/27/musuzosexulekuz.pdf
    • http://lotuscoaching4kids.com/uploads/1/3/0/2/130270905/f9e625.pdf
    • http://djsacademy.com/uploads/1/3/0/3/130323315/130323315.html#hector+acosta+amorcito+enfermito

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016fc.bin
f9093d3767220f03ef3cd91f0c4f1ab9bf5e3c2c3fb83368f465b53bd7512dce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16FC 8960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.