Malicious PDF — malware analysis report

Static analysis result for SHA-256 2edbfdf1214d2b96…

MALICIOUS

PDF

39.0 KB Authoring application: Karbon
MD5: dc545aebe3c2db2d20c80b1a8cb4caaf SHA-1: 1b7d9ad7135197bdf38e41990910a2e0fecd4bf9 SHA-256: 2edbfdf1214d2b9672a954e2fa00a7cdca9a6afc87ddd98dbe42d807860e06a9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits characteristics of a link farm, containing numerous embedded URLs pointing to other PDF documents. This technique is often used to distribute malicious content or facilitate phishing attacks. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support the malicious nature of this file. The embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seelenleben.ch/uploads/1/3/0/8/130814187/27a179dbdafda46.pdf
    • http://onestepforwardinspirations.com/uploads/1/3/0/7/130738779/c3e490d985c586.pdf
    • http://joulukortit.net/uploads/1/3/0/3/130323151/jifinatu_fijakotov_ferexewipeguj_zoted.pdf
    • http://alyssaclements.com/uploads/1/3/0/5/130546209/2bd183f9d.pdf
    • http://legalpdq.com/uploads/1/3/0/7/130776428/linogex.pdf
    • http://nealcm.com/uploads/1/3/0/8/130813782/c058a4ee21f7.pdf
    • http://daisxo415.xyz/uploads/1/3/0/5/130543855/9003307.pdf
    • http://robanka.com/uploads/1/3/0/4/130483322/wumivakim.pdf
    • http://www.tchikidavis.com/uploads/1/3/0/5/130588805/woxuxajaxivasixawa.pdf
    • http://lsgreenclean.com/uploads/1/3/0/3/130323511/6564142.pdf
    • http://koasports.com.au/uploads/1/3/0/3/130379138/21d98271d10468e.pdf
    • http://myndscentcompany.com/uploads/1/3/0/6/130621607/1340269.pdf
    • http://melangeemporium.com/uploads/1/3/0/2/130289498/tifuviloxara-vanuwim.pdf
    • http://happyhornet.com/uploads/1/3/0/3/130323412/tanaju.pdf
    • http://vintagehomenewyork.com/uploads/1/3/0/3/130313391/4062813.pdf
    • http://johnirwinsonlinebusiness.com/uploads/1/3/0/7/130739754/vifenedezoxigen.pdf
    • http://www.rachelkatewood.co.uk/uploads/1/3/0/3/130324050/jipulatasuputez-zubak-fejerizo-fipes.pdf
    • http://jamaicalandoffilm.com/uploads/1/3/0/3/130379514/3788511.pdf
    • http://courtneyandneal.com/uploads/1/3/0/7/130738603/4146279.pdf
    • http://tampabaybeertrail.com/uploads/1/3/0/7/130739452/0182a3cd.pdf
    • http://5nq9b.slpny.com/uploads/1/3/0/5/130551524/130551524.html#arduino+led+matrix+alarm+clock

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000361b.bin
cdf3b1d5dbc95ed82a20a2eba153a8c2d0ead0c8a8d98d7a2451588bb4dc858f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x361B 8876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.