Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ad32faa57e1fc4f…

MALICIOUS

PDF

49.9 KB Authoring application: Karbon
MD5: 12733074cfe4a1f73c7eaa55e844617f SHA-1: 089c94de5723a24a2510b4d5368f9676872006fa SHA-256: 2ad32faa57e1fc4f5963cc314b105f757ae45a56bdc4d8e25b6f5d73a209826c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This technique, identified as PDF_SEO_LINK_FARM, is commonly used to create link farms for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier further support its malicious nature, indicating it is likely a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://potusnewschannel.com/uploads/1/3/0/7/130740158/puritope.pdf
    • http://mexpertnyc.com/uploads/1/3/0/4/130490338/dewuwazapur.pdf
    • http://clearstickerpaper.com/uploads/1/3/0/5/130590596/teniburutev_sizezigij_nupuroxazowi_kidaxupedu.pdf
    • http://meat-taffy.net/uploads/1/3/0/7/130776693/8362337.pdf
    • http://stuffthatsneat.com/uploads/1/3/0/5/130539336/f13b8e2e20e1.pdf
    • http://lakesfoodandcraft.com/uploads/1/3/0/2/130272482/todexunapuxobukawa.pdf
    • http://northstarpropertiesct.com/uploads/1/3/0/6/130621437/finoxixi_dasiborerotupeb_fetozunuk.pdf
    • http://mydrwalker.com/uploads/1/3/0/6/130621720/4861904.pdf
    • http://beltwayig.com/uploads/1/3/0/5/130588517/fugananesega-fuwenub-wagonem.pdf
    • http://platicus.net/uploads/1/3/0/5/130588786/5200364.pdf
    • http://everythinghighschool.com/uploads/1/3/0/5/130588867/733a9b2802d.pdf
    • http://sonoranshadows.com/uploads/1/3/0/2/130291433/5166606.pdf
    • http://heatherzidle.com/uploads/1/3/0/7/130775151/gewunewurogofum-fuvoze-wivaselezote-fulos.pdf
    • http://designsbycarolann.com/uploads/1/3/0/6/130620379/xoxutejuw.pdf
    • http://teamborkowski.com/uploads/1/3/0/6/130620354/somugu.pdf
    • http://www.dailyactsofkindness.org/uploads/1/3/0/7/130775506/maxobo.pdf
    • http://couplingmanufacturers.com/uploads/1/3/0/5/130588858/wubufosasozof_meruju_lenuka_pebifuwudomu.pdf
    • http://knowledgelord.com/uploads/1/3/0/7/130739375/ronorosewawesari.pdf
    • http://betterburner.com/uploads/1/3/0/6/130639296/rivasimereki.pdf
    • http://nickdeanconsulting.com/uploads/1/3/0/5/130551245/937448932428aaf.pdf
    • http://s5xpv.bpmtc.com/uploads/1/3/0/5/130540604/130540604.html#spherical+aberration+in+spectacle+lenses

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fe8.bin
5dcb33c16ed947e0acef3db602e0ed862599d896487bde5c74a394a503427e33		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE8 7692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.