Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d765c93a2e4eb1a…

MALICIOUS

PDF

49.7 KB Authoring application: Karbon First seen: 2020-09-24
MD5: 9566ff2f248af3101922fd3753ef92c7 SHA-1: 8c0ba33001dd003baf9a18e3365cab004836b668 SHA-256: 4d765c93a2e4eb1aab5ce40e6b4cbf05b9fe249ebaa7a224961e0c728361a087
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links to other PDF files hosted on various domains. This behavior is indicative of a link farm or redirection scheme, likely intended to lead users to malicious content or phishing pages. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-generation motive.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://foreverplay.org/uploads/1/3/0/5/130589411/kisofajeduxajuxa.pdf In PDF document text
    • http://www.jbestportfolio.com/uploads/1/3/0/6/130620454/gajonifurerid_pibimew.pdfIn PDF document text
    • http://naturebringsmepancackes.com/uploads/1/3/0/7/130740492/rinimujurejovofo.pdfIn PDF document text
    • http://mesh1nfo.com/uploads/1/3/0/6/130621004/b67c8b8b.pdfIn PDF document text
    • http://mail.lisalanducci.com/uploads/1/3/0/2/130272640/f6dadd5445.pdfIn PDF document text
    • http://swilliamsphotos.com/uploads/1/3/0/7/130776779/3590830.pdfIn PDF document text
    • http://4bcenter.com/uploads/1/3/0/5/130543020/2123895.pdfIn PDF document text
    • http://proletas.com/uploads/1/3/0/7/130739500/nogitutag.pdfIn PDF document text
    • http://purepulse.net/uploads/1/3/0/4/130488935/4583509.pdfIn PDF document text
    • http://upclear.org/uploads/1/3/0/5/130589037/2747413.pdfIn PDF document text
    • http://www.the-young-contrarian.com/uploads/1/3/0/2/130288378/a246131f329c705.pdfIn PDF document text
    • http://drreedallergydoctor.com/uploads/1/3/0/5/130540583/facb9.pdfIn PDF document text
    • http://jbriggsmultimedia.com/uploads/1/3/0/5/130588824/kegufikojaxego_zipasuxirobu.pdfIn PDF document text
    • http://www.mygetfitkitchen.com/uploads/1/3/0/3/130379426/wujefegavikut-fazikufijojob-bivitosino.pdfIn PDF document text
    • http://nmation.org/uploads/1/3/0/7/130739156/4177051874.pdfIn PDF document text
    • http://www.thehlifeonline.com/uploads/1/3/0/9/130969162/19e4d.pdfIn PDF document text
    • http://modern-energy.co.uk/uploads/1/3/0/2/130271076/2935141.pdfIn PDF document text
    • http://bacalandersengarrison.com/uploads/1/3/0/4/130478602/39b6c19329.pdfIn PDF document text
    • http://www.ztvguide.com/uploads/1/3/0/6/130639949/5cb29d860e.pdfIn PDF document text
    • http://mevsimyalitim.com/uploads/1/3/0/3/130379757/datonid.pdfIn PDF document text
    • http://stevengoodey.adviser.live/uploads/1/3/0/6/130639517/59f66be9ec6644a.pdfIn PDF document text
    • http://ezinvoicepro.com/uploads/1/3/0/7/130775982/e46e2fe.pdfIn PDF document text
    • http://turneduplife.voyagerwebsites.com/uploads/1/3/0/4/130490875/130490875.html#treatment+of+acute+hypercapnic+respiratory+failureIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
🗂 Part of campaign: mrvsteaks.com 4 samples

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x48F5 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
font_01_sfnt_off0000603b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x603B 8288 bytes
SHA-256: 56028ce893d1f8883395fb92a43e9dd78ce7507fe0462af069ec1537b7fd4387

Open this report in the interactive analyzer, or submit your own file for analysis.