Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d0f0d8ad62a399a…

MALICIOUS

PDF

45.9 KB Authoring application: Karbon First seen: 2020-09-24
MD5: 14c4143b964aba8dcb214fd11230d4f5 SHA-1: 3eede904dd361baa18aba679408f4aa93c1d0958 SHA-256: 5d0f0d8ad62a399a5fc18fe372a8c2b1b600640d1b7de8682fb2bc555540dfa5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs pointing to other PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute a large volume of content, potentially malicious. The ML classifier and ClamAV detection further support its malicious nature, flagging it as phishing or malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://perfectcentral.net/uploads/1/3/0/5/130540525/gowewogiz.pdf In PDF document text
    • http://barrygjohnsonsr.com/uploads/1/3/0/3/130313265/tunalug_mubutorizuj_farax_tuwipalawozag.pdfIn PDF document text
    • http://rollnrock.com/uploads/1/3/0/6/130604616/191579.pdfIn PDF document text
    • http://mozotu.cloudycherry.net/uploads/2020/01/27/ad2f384e993c2.pdfIn PDF document text
    • http://adcounselling.net/uploads/1/3/0/4/130483322/2241787.pdfIn PDF document text
    • https://tidomezenu.weebly.com/uploads/1/3/0/2/130289352/waxodilapisu-bokazuresamit.pdfIn PDF document text
    • http://jokavo.ekstra-147.ru/uploads/2020/01/29/milugamin.pdfIn PDF document text
    • http://brandieckertphotography.com/uploads/1/3/0/4/130435835/luzinubabuvog.pdfIn PDF document text
    • http://keriakvirginhair.com/uploads/1/3/0/2/130287311/debedosulasulus-wajukizavaliv-raraxoluko-popopimu.pdfIn PDF document text
    • http://brandmediax.com/uploads/1/3/0/6/130620266/zeren-kofixixosox-dowekefekubu.pdfIn PDF document text
    • http://theaanh.com/uploads/1/3/0/5/130550881/130550881.html#pulmonary+hypertension+pregnancy+mortalityIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
🗂 Part of campaign: jeffandeo.com 4 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EE 7988 bytes
SHA-256: e1b1eff9c55e26d204134904c89193550934cdfcf13e2be0bef454ee809face0
font_01_sfnt_off00006d4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D4D 16040 bytes
SHA-256: 523bb29b8a8b3521d4eea3d187afb5c56f6eabbb7be7fe3c71306fd84fb19fdb

Open this report in the interactive analyzer, or submit your own file for analysis.