Malicious PDF — malware analysis report

Static analysis result for SHA-256 41cb01438ce02ae7…

MALICIOUS

PDF

47.1 KB Authoring application: Karbon
MD5: 319bb195e32e2016232273347ab4287c SHA-1: 3e22956ef4970a7822a77c332e041044117fe7ea SHA-256: 41cb01438ce02ae7e7107984c6187bd5be5b6de48dfd8f98602a6ef5e1140249
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The document body is heavily obfuscated and does not provide clear user-facing text, but the heuristic firings strongly suggest a malicious link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrspaynes.com.au/uploads/1/3/0/3/130313766/8e00100c6b.pdf
    • http://christmasinchilhowie.com/uploads/1/3/0/5/130545334/571585.pdf
    • http://accentuatespeechservices.com/uploads/1/3/0/4/130488493/1613093.pdf
    • http://artistsmusesandlovers.com/uploads/1/3/0/2/130272488/1fed42.pdf
    • http://themedicalscienceeditor.org/uploads/1/3/0/4/130491166/ba67e.pdf
    • http://csrasalesforceadmins.com/uploads/1/3/0/6/130604114/9239725.pdf
    • http://drberryconsulting.com/uploads/1/3/0/4/130488786/4855552.pdf
    • http://patients2patients.net/uploads/1/3/0/4/130489082/dekugurod.pdf
    • http://divineemergence.com.au/uploads/1/3/0/2/130287942/3249837.pdf
    • http://radmanusa.com/uploads/1/3/0/2/130289509/92c15.pdf
    • http://mrkellysupholstery.com/uploads/1/3/0/8/130814397/1322533.pdf
    • http://workplaybook.com/uploads/1/3/0/6/130603682/0eff737d.pdf
    • http://constant4mayor.com/uploads/1/3/0/2/130288380/7599046.pdf
    • http://kidfirst.net/uploads/1/3/0/7/130738629/2df444257baa14.pdf
    • http://touchforhealth.co.za/uploads/1/3/0/6/130604018/nowomon.pdf
    • http://movies-music-and-games.com/uploads/1/3/0/2/130289719/8209137.pdf
    • http://rightwrite.net/uploads/1/3/0/4/130483673/zavaxurekeb-kekexidibatut-vunom.pdf
    • http://artoftouchspa.com/uploads/1/3/0/5/130546593/jakaniwibexuwav.pdf
    • http://mrsindler.com/uploads/1/3/0/5/130546196/nakatesul-bapulefo-ponarasagib-dopupubepex.pdf
    • http://allstatepavingandmasonry.com/uploads/1/3/0/4/130435966/didopeluro.pdf
    • http://theelfbox.com/uploads/1/3/0/6/130604606/130604606.html#air+force+x+y+group+syllabus+2020+in+hindi
    • http://divineemergence.com.au

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000342e.bin
d70a10c5810e819b0d76ae69e0ef39a922c39ce765ecab6d7154f7d43db1d069		 pdf-font-stream PDF embedded font (sfnt) at offset 0x342E 12684 bytes
font_01_sfnt_off00005820.bin
5970a991a5c0a0ffc3dfe0df82f95ce3bffcab9093135d32b1d6124a91932d64		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5820 8184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.