Malicious PDF — malware analysis report

Static analysis result for SHA-256 220e3bc7f2c204a5…

MALICIOUS

PDF

44.7 KB Authoring application: Karbon
MD5: 2ec0f3aabf859ec2f6e186af1432732b SHA-1: 596d8bd024ba1f7c1a5410a30c7a8f8efc387a6d SHA-256: 220e3bc7f2c204a5e33834a936695e2b14b24e46ed674fe2f6e9b13b12799631
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on numerous domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection strongly support its malicious nature, classifying it as phishing-related malware. No scripts were extracted, and the document body is heavily obfuscated, but the primary attack pattern is the distribution of links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://curatedchoice.co/uploads/1/3/0/2/130270874/norazuk-jupojobojiku.pdf
    • http://logicalspacedesign.ca/uploads/1/3/0/4/130435661/xiduvusarabu_meperuratu_sadefekuvuvitab.pdf
    • http://ecosselele.com/uploads/1/3/0/7/130775750/matewerusinemeni.pdf
    • http://vintagecoutureweddings.com/uploads/1/3/0/5/130589050/pisoxunusa.pdf
    • http://morglosec.com/uploads/1/3/0/6/130604657/kifelenedejij.pdf
    • http://seodublin.org/uploads/1/3/0/5/130540882/rasitufomabetifam.pdf
    • http://wamits.net/uploads/1/3/0/6/130639547/wuliko.pdf
    • http://www.snowsportequipment.net/uploads/1/3/0/7/130739625/4691347.pdf
    • http://hcffmc15.com/uploads/1/3/0/7/130775029/bafc1d77a6.pdf
    • http://musicandplants.com/uploads/1/3/0/7/130739786/9088408.pdf
    • http://www.justemilyandtom.co.uk/uploads/1/3/0/7/130739577/zikureler.pdf
    • http://myhealinghands.org.uk/uploads/1/3/0/7/130775274/6013835.pdf
    • http://www.brennernixon.com/uploads/1/3/0/5/130589279/e7f020f5ce3.pdf
    • http://webdisk.lynn-gustafson.com/uploads/1/3/0/6/130605146/xikazevafe_savosutuk_jaloruj_bekikez.pdf
    • http://www.slaccountingsolutions.com/uploads/1/3/0/8/130813917/9f798b2.pdf
    • http://concordlawncareservices.com/uploads/1/3/0/5/130588532/giziva-fasozupoveg-pemewavafuwir-soxotaje.pdf
    • http://www.openhomeforsale.com/uploads/1/3/0/2/130272072/6489200.pdf
    • http://digitaldocmd.com/uploads/1/3/0/9/130969603/130969603.html#40+which+government+policy+will+shift+the+aggregate+demand+curve+to+the+right

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004fce.bin
f5fa0c040217602237a14224039a7457b0e5098d10855e481fa195c8bf9de207		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4FCE 8892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.