Malicious PDF — malware analysis report

Static analysis result for SHA-256 505aef5a8711df49…

MALICIOUS

PDF

42.4 KB Authoring application: Karbon
MD5: 058208fb5edb700ac2593d20408159ff SHA-1: 6762d078d2404283b6036553667b605a1d453aaa SHA-256: 505aef5a8711df492e81b62582d9ecae68e049e42eb06ab6150bd86a6f2961dd
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files, a technique commonly used for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body, though partially corrupted, suggests an attempt to disguise the malicious content as educational material.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://openparks.net/uploads/1/3/0/8/130814909/eb590da9.pdf
    • http://ohinternet.net/uploads/1/3/0/5/130539097/dipebugif.pdf
    • http://bayareaboatandhomeloans.com/uploads/1/3/0/4/130483400/b8fb7fc126594f0.pdf
    • http://anaeugeniophotography.org/uploads/1/3/0/6/130604554/jufemotojagot.pdf
    • http://kupetspinkinvitational.com/uploads/1/3/0/5/130588445/laluf.pdf
    • http://www.citycollegelibrary.com/uploads/1/3/0/8/130814001/bopimivula-bosiwamodozabe-jegijodopag.pdf
    • http://aptdevelopmentgroupllc.org/uploads/1/3/0/5/130543210/7981209.pdf
    • http://christiancardsandphotos.org/uploads/1/3/0/6/130603961/a431e3ee.pdf
    • http://konjstudio.net/uploads/1/3/0/4/130483603/1737774.pdf
    • http://stageleftperformingarts.com/uploads/1/3/0/3/130379110/muzuruxobefevig-bejepogub-pexeweno.pdf
    • http://quaomenyulechenghuodongtuijian.br3h.com/uploads/1/3/0/6/130639906/9589104.pdf
    • http://dronecoaches.com/uploads/1/3/0/8/130813732/dafojilasakovedu.pdf
    • http://chokola.com/uploads/1/3/0/5/130551211/1416838185.pdf
    • http://jrgenua.com/uploads/1/3/0/2/130292104/2674901.pdf
    • http://cherry-supply.com/uploads/1/3/0/2/130273845/mulumirobabomur.pdf
    • http://www.northwestprogress.com/uploads/1/3/0/4/130478882/jukiv.pdf
    • http://www.nrvprocessing.com/uploads/1/3/0/5/130543121/noxugowix.pdf
    • http://mail.lquertportfolio.com/uploads/1/3/0/6/130621626/5828622.pdf
    • http://candacegraham.com/uploads/1/3/0/7/130738936/regoluso-kemerijo-pozogemugeva.pdf
    • http://directroofrestoration.com/uploads/1/3/0/2/130289243/130289243.html#simple+present+and+simple+past+tense+exercises+pdf+with+answers
    • http://cherry-supply.com/uploads/1/3/0/2/130273845/m

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003027.bin
40a403f8312ff9c93041e514e965a4d57d797ba541f1da729710ef172887bfc2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3027 16060 bytes
font_01_sfnt_off00004761.bin
27cb9f3f9fae27e65cc2b21b56bf1f70a58a4168610e68f90caeaa3337d683f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4761 7692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.