Malicious PDF — malware analysis report

Static analysis result for SHA-256 6589a823693f38f1…

MALICIOUS

PDF

41.4 KB Authoring application: Karbon
MD5: 2f796a97550bffd607e9699ebbaa0dfa SHA-1: 06b3debd1c34111451d2807581b95e0892b2687c SHA-256: 6589a823693f38f1bc523c9d3ed7dcffb81c7446ce3f766f62d41ec694e9c6d4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links to external PDF files hosted on various domains, identified as a 'PDF_SEO_LINK_FARM' heuristic. This suggests a phishing or SEO manipulation tactic, aiming to drive traffic to potentially malicious or spam content. The ClamAV detection and ML classifier further support its malicious nature, classifying it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. No scripts were extracted, but the extensive URL list is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nosizunodi.kuhni-msc11.icu/uploads/2020/01/28/5240419.pdf
    • http://musicmastertraining.com/uploads/1/3/0/6/130605065/76b7b9c1dfd.pdf
    • http://tampa321sold.com/uploads/1/3/0/6/130605442/509595.pdf
    • http://usseawolf.com/uploads/1/3/0/6/130639876/mugawep.pdf
    • http://baystategalvanizing.com/uploads/1/3/0/5/130547215/kubudusogefajakulabe.pdf
    • http://artisaneatware.co.za/uploads/1/3/0/5/130588498/tiveresijixaxububiga.pdf
    • http://ps110k.com/uploads/1/3/0/4/130490193/ee0819c6.pdf
    • http://nagsthlm.com/uploads/1/3/0/5/130550871/3079929.pdf
    • http://athleticsnorth.net/uploads/1/3/0/5/130588810/zotopad.pdf
    • http://warren.capetown/uploads/1/3/0/7/130740378/130740378.html#3d+photo+frame+model+free
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011e0.bin
950246c520cc9a6fce5970a575940ef6cd5bd31bf8e980fffa1d771faf5bdac8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E0 8368 bytes
font_01_sfnt_off000066ef.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66EF 2616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.