Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c56d4d5ac45c0b0…

MALICIOUS

PDF

38.5 KB Authoring application: Karbon
MD5: e850b1848754609dc7c293a626deeab8 SHA-1: 089883a2d749013fe4b82596e181fb5aee1e7227 SHA-256: 5c56d4d5ac45c0b0560c7f71d9c3ef5118c8eeabe8f56257cb38ec4dceae3ade
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external PDF links, with the first identified URL being http://cadenceresource.com/uploads/1/3/0/7/130776611/xojizebapi_rizediwirasegu_lepixaki_kodapuxa.pdf. This suggests the document's primary purpose is to redirect users to a network of other potentially malicious or spam-related PDF documents.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cadenceresource.com/uploads/1/3/0/7/130776611/xojizebapi_rizediwirasegu_lepixaki_kodapuxa.pdf
    • http://fitrition.com.au/uploads/1/3/0/6/130604361/2301777.pdf
    • http://newmarlboroughfiber.org/uploads/1/3/0/5/130588159/69f8e51a2e268.pdf
    • http://www.cmiraclelashes.com/uploads/1/3/0/8/130813586/6228937.pdf
    • http://atlantapermaculture.com/uploads/1/3/0/6/130620268/bibebusupo_pemomovemep_kijilekem.pdf
    • http://theknittingroom.co.uk/uploads/1/3/0/8/130813651/zefuxelusejeb.pdf
    • http://mta-sts.mail.alesiagriffin.net/uploads/1/3/0/8/130813923/7cd1c29e3.pdf
    • http://northeastflowershop.com/uploads/1/3/0/6/130603943/zijategamute.pdf
    • http://answer-design.net/uploads/1/3/0/3/130379169/tenadavoxanoj.pdf
    • http://brawomusical.com/uploads/1/3/0/6/130604179/xuxovigikavage.pdf
    • http://born-again-resale.com/uploads/1/3/0/5/130550858/130550858.html#boolean+expression+logic+circuit+diagram

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e67.bin
c2140b3571e361e49786abf6bd19af12a7139b21fc4d345bdb3dcedc32f8aed2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E67 8556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.