Malicious PDF — malware analysis report

Static analysis result for SHA-256 65b9fabe18859767…

MALICIOUS

PDF

36.0 KB Authoring application: Karbon
MD5: e19dbc85b564afa00920d02b5f0c53a2 SHA-1: 8bf5530e36c6d18725760eb5711d227d5d0c99d8 SHA-256: 65b9fabe18859767bb8bcdbae3799d5c368227a9f81376fd1e80c864b2188d16
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which are likely intended to direct users to external PDF files. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as Pdf.Phishing.TtraffRobotInstall. While no scripts were extracted, the sheer volume of outbound links suggests a campaign to distribute malicious content or manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://attorneyfloridaprobate.net/uploads/1/3/0/7/130739688/9533326.pdf
    • http://oaklandslodgebandb.co.uk/uploads/1/3/0/5/130551019/713377.pdf
    • http://citizensarmory.net/uploads/1/3/0/5/130551188/lupexerapasixi.pdf
    • http://worksafehsesolutions.com/uploads/1/3/0/6/130605080/3907398.pdf
    • http://illustratie57.com/uploads/1/3/0/5/130546880/puribof.pdf
    • http://drinkhereplayhere.com/uploads/1/3/0/6/130639526/425dcde9080.pdf
    • http://annotateit.net/uploads/1/3/0/7/130739917/2210832.pdf
    • http://www.masondixonghosttours.com/uploads/1/3/0/4/130488851/lidixarukomoziseg.pdf
    • http://arkansaspropertymaintenance.com/uploads/1/3/0/7/130775796/2514910.pdf
    • http://lunarlogs.com/uploads/1/3/0/7/130776399/perulon.pdf
    • http://michaeldubose.net/uploads/1/3/0/2/130270808/9715521.pdf
    • http://privetst.com/uploads/1/3/0/8/130813945/moxevaxiviwalisufo.pdf
    • http://buildingblockslearningnetwork.com/uploads/1/3/0/9/130968973/8307907611a5de4.pdf
    • http://revolutionofsenses.org/uploads/1/3/0/4/130483911/9765363.pdf
    • http://www.workingclasskids.com/uploads/1/3/0/3/130379365/a02a0091.pdf
    • http://www.peakathleticsystems.com/uploads/1/3/0/5/130551116/130551116.html#doc+to+pdf+converter+software+filehippo

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030f2.bin
61988f2f09d799f9236dbe51600b06b4ef6f9e0af4305d0e5bdd2dd73164b47b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30F2 8252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.