Malicious PDF — malware analysis report

Static analysis result for SHA-256 63d4f7b1d39f4314…

MALICIOUS

PDF

47.2 KB Authoring application: Karbon
MD5: 1be9b7c5b37b42586c3b050c946affca SHA-1: 3ea19927ebef3647fb7e9884f4bdaa4d99f6687c SHA-256: 63d4f7b1d39f43146a08575a0772d76952b2920cff3851c4f0ac9c63e54378aa
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure itself facilitates the redirection to numerous external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xoganikodi.mycrazylove.com/uploads/2020/01/28/929322.pdf
    • http://mikesrefinishing.com/uploads/1/3/0/2/130274032/wosur_lizofisenero_zopefu.pdf
    • https://ruvuriwi.weebly.com/uploads/1/3/0/5/130551095/jodinow.pdf
    • http://nordicxenia.com/uploads/1/3/0/4/130483667/8041876.pdf
    • http://nadiafarah.com/uploads/1/3/0/5/130588606/kasojepanobozu.pdf
    • http://jemuwax.ewrty.xyz/uploads/2020/01/29/30721.pdf
    • http://lifeofastreetdog.com/uploads/1/3/0/6/130605259/e72498fd931c6.pdf
    • https://doxinavom.weebly.com/uploads/1/3/0/2/130273803/xodoripesete.pdf
    • http://coworkinginbristol.com/uploads/1/3/0/6/130604795/eb9580a3.pdf
    • http://cacfountainoffire.org/uploads/1/3/0/2/130271139/vavivar.pdf
    • https://gutamado.weebly.com/uploads/1/3/0/2/130271015/6812c396c.pdf
    • https://gofugubax.weebly.com/uploads/1/3/0/3/130313306/xonasodedali-kukagejaz.pdf
    • http://blsconsultingfirm.com/uploads/1/3/0/6/130604537/wuwarepamur-gipukumilowewo-vilukativin-jolabapuzuk.pdf
    • http://myeclecticyoga.com/uploads/1/3/0/6/130604467/abdbcc2f5b.pdf
    • http://befuxakax.americanasdobrasil.com/uploads/2020/01/28/a79f5f5.pdf
    • http://backupwill.weebly.com/uploads/1/3/0/4/130483110/wakekuruzila.pdf
    • http://statewidelandsales.com/uploads/1/3/0/5/130542983/dbfe734e1.pdf
    • http://gateway-3ds.ru/uploads/2020/01/28/3674876.pdf
    • http://mujad.igrarium.com/uploads/2020/01/27/8b7819364a3b.pdf
    • https://xizewunud.weebly.com/uploads/1/3/0/5/130551890/c066baa07e1f177.pdf
    • http://lonestarbeecompany.com/uploads/1/3/0/6/130604860/961f25.pdf
    • http://nidotize.sharlanov.ru/uploads/2020/01/27/bunezejimik.pdf
    • http://allergy.mediutopia.com/uploads/1/3/0/6/130603860/130603860.html#business+environment+concept+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fb3.bin
dab44f42606a30e8945c177b029ab735f86c0b00743de1b9abedf86c397f5b22		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB3 7864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.