Malicious PDF — malware analysis report

Static analysis result for SHA-256 529739d63dd32d97…

MALICIOUS

PDF

40.5 KB Authoring application: Karbon
MD5: e73f25bb8e7639e6fc413073f68d283e SHA-1: b6ff8218e01662ff862e352c0bfa9d0bfffc1314 SHA-256: 529739d63dd32d97b496e8c7fe3a2982e9dca94b7ac9bbe3f322c8d8ed1073f4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This technique, identified as PDF_SEO_LINK_FARM, is often used to distribute malicious content or redirect users to phishing sites. The ML classifier and ClamAV detection strongly indicate malicious intent, with ClamAV identifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document body text, though truncated and containing garbled characters, mentions 'Chlamydia symptoms', which could be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://battlecreekendo.com/uploads/1/3/0/7/130776105/38ac9bdf.pdf
    • http://littleredwagonsweets.com/uploads/1/3/0/5/130551270/9464139.pdf
    • http://dotdot.tech/uploads/1/3/0/7/130738794/2b590e00790.pdf
    • http://returnoninitiative.us/uploads/1/3/0/6/130604285/2905969.pdf
    • http://dinosgrilledburger.com/uploads/1/3/0/6/130604476/fejojamepabegujuf.pdf
    • http://philipejike.com/uploads/1/3/0/4/130483110/gasegokisa_legaj_gezenitimaw.pdf
    • http://mhdodgebrawl.com/uploads/1/3/0/7/130775363/2ad41a071818a77.pdf
    • http://theoxfordhouseofbeauty.com/uploads/1/3/0/7/130776269/85d2227f.pdf
    • http://newrichmondoh.org/uploads/1/3/0/2/130273944/monuwozera.pdf
    • http://thambithomas.com/uploads/1/3/0/4/130478663/vigoluvulip_bokoxefixosa.pdf
    • http://betteryet.net/uploads/1/3/0/5/130539115/dazorezaxo.pdf
    • http://movingmedicineali.com/uploads/1/3/0/6/130640010/nikomozozejeto_gafaruvadep_juduvavawekeze_morikebomug.pdf
    • http://liftupacademy.com/uploads/1/3/0/5/130540504/a19d8f78b54.pdf
    • http://mywinningkidsseftworth.com/uploads/1/3/0/5/130550880/tulakajaxag-wiwilejofuk-xujifexen-kerubuver.pdf
    • http://chirpsofftheoldblock.com/uploads/1/3/0/4/130483632/1492901.pdf
    • http://motherhenmusic.org/uploads/1/3/0/7/130739827/771ad54.pdf
    • http://repealcongress.com/uploads/1/3/0/5/130538817/9577729.pdf
    • http://runwildcle.com/uploads/1/3/0/3/130312912/gavenaripudufu.pdf
    • http://mfatihekinci.net/uploads/1/3/0/5/130539188/siwoxexowowuji-riwagabuw-ketimejiteba.pdf
    • http://al-nusr.net/uploads/1/3/0/4/130435843/8718640.pdf
    • http://stacysfoundation.org/uploads/1/3/0/7/130775102/fed7959e.pdf
    • http://michelleleblancshortstories.com/uploads/1/3/0/5/130539182/857017.pdf
    • http://passerprojects.com/uploads/1/3/0/3/130324324/9055653.pdf
    • http://tabithasdesigns.org/uploads/1/3/0/7/130739101/71b1f4bf2f04f.pdf
    • http://newmarkethanaiohana.com/uploads/1/3/0/7/130739602/2677774.pdf
    • http://nuobeijing.devsite-1.com/uploads/1/3/0/5/130588695/130588695.html#chlamydia+symptoms+return+after+treatment
    • http://thambithomas.com/uploads/1/3/0/4/130478663/vigolu

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a01.bin
89a38a7e1341953f8d7e19e85e07ca3956bd8dba06085546f42db54b432db5c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A01 7832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.