Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f1781059c962f21…

MALICIOUS

PDF

53.6 KB Authoring application: Karbon
MD5: 6ed86dd6dce2f1eba5a4cbf0f80f1293 SHA-1: 52a7f81d02377778a0f179c1b610606cd29e67f3 SHA-256: 2f1781059c962f21c3c957ea5324ca44fd31e4e5232bd219b3b05335fac5e47a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded URLs, indicating a link farm designed to direct users to potentially malicious content. The heuristic PDF_SEO_LINK_FARM specifically flags this behavior, suggesting the document's primary purpose is to facilitate phishing or malware distribution through these links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nojabavojigul.weebly.com/uploads/1/3/0/3/130379051/munal.pdf
    • http://diamondbabygems.com/uploads/1/3/0/6/130639750/4266396.pdf
    • http://modosmedia.com/uploads/1/3/0/4/130476185/9962951.pdf
    • http://kelownavacationseasonalrentals.com/uploads/1/3/0/4/130436121/b5f62a.pdf
    • http://lilamomeg.myopros.tech/uploads/2020/01/27/c5109a114c7c5d.pdf
    • http://heatherscustomcookies.com/uploads/1/3/0/6/130620224/wizakiw_wojelodezelufi_pulifi.pdf
    • http://10thirtychoir.org/uploads/1/3/0/3/130324419/7942659.pdf
    • https://kisozebiduz.weebly.com/uploads/1/3/0/5/130589019/rukosofuledilegos.pdf
    • http://keepamericatrumpfree.com/uploads/1/3/0/4/130476786/sukeroxanufukak_xeguwuni.pdf
    • http://shopcenter16.fun/uploads/2020/01/28/3505151.pdf
    • http://kelufu.aseralle.me/uploads/2020/01/29/7008931.pdf
    • http://laurencegestalt.com/uploads/1/3/0/2/130272234/sijokegofokenuvilom.pdf
    • http://mrscooke.com/uploads/1/3/0/3/130313541/2756017.pdf
    • http://bodyworkbybarb.com/uploads/1/3/0/2/130271098/130271098.html#dibels+8th+edition+lausd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001156.bin
2d6ba1d0c20742e5f7a4c943629566d9a26cdffc65b18080a14f7e99a708eeba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1156 9232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.