Malicious PDF — malware analysis report

Static analysis result for SHA-256 49fbfcf6f879d73c…

MALICIOUS

PDF

43.6 KB Authoring application: Karbon
MD5: 0afe9cce33d923fe665b80ab972e829e SHA-1: b9c06b6f22650de607a5caa9ddc8d168e2692234 SHA-256: 49fbfcf6f879d73ce2403123ec91183adefb0a72b1576eb8622f6a4f981626b7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, and the PDF_SEO_LINK_FARM heuristic confirms the presence of numerous external links. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or execution methods.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xafuvoja.weebly.com/uploads/1/3/0/5/130542758/6672421.pdf
    • http://gixini.itechieguru.com/uploads/2020/01/28/e0de1010d11f7c4.pdf
    • http://lasalledumoulinneuf.com/uploads/1/3/0/4/130489343/1821688.pdf
    • http://blogg.allegro-as.no/uploads/1/3/0/4/130483110/7bb1f949fb.pdf
    • http://thejoyofjob.com/uploads/1/3/0/6/130603772/6463509.pdf
    • http://xonu.regpanel.club/uploads/2020/01/27/nilenota.pdf
    • http://regepas.veranda-tort.ru/uploads/2020/01/28/zukopojuregosek-juriwa.pdf
    • http://gobizuxefa.dorklo.xyz/uploads/2020/01/29/1650607.pdf
    • http://poxu.hotelimperiya.ru/uploads/2020/01/28/740e1079e59.pdf
    • http://mrtexel.com/uploads/1/3/0/5/130550774/334287.pdf
    • https://kisalivesizagol.weebly.com/uploads/1/3/0/4/130435706/vazotaj-zagukepuzaba-zakise.pdf
    • http://jungandsisco.com/uploads/1/3/0/6/130604250/9570fefe7.pdf
    • http://jmcounselingsolutions.com/uploads/1/3/0/3/130323937/c571d5b1127d65a.pdf
    • http://samoma.epiad.com/uploads/2020/01/27/lelefimefitas.pdf
    • http://mychinesewatch.com/uploads/1/3/0/6/130604113/130604113.html#charles+dickens+barnaby+rudge+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001413.bin
deb61db2fbb55022a9e30f3b29179c03d6ee67006935a394a2c3cb1b7ae84c2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1413 9148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.