Malicious PDF — malware analysis report

Static analysis result for SHA-256 68d9495058fc3ed3…

MALICIOUS

PDF

39.6 KB Authoring application: Karbon
MD5: 12a41181fbd79abde54fef2188b35e49 SHA-1: d5ad1c60f642ee020cf3dc3939abfc67437959c9 SHA-256: 68d9495058fc3ed3cec3bcdbef1f93ae19800ad30e4019e8c6d706a7fc08b7f5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a coordinated effort to distribute content or manipulate search engine results. The ML_NYX_PDF_MALICIOUS and ClamAV detections further support its malicious nature, likely as a phishing or content distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kasivisalakshi.com/uploads/1/3/0/5/130590096/lotobinezu_tinisebeged_rinux_zixik.pdf
    • http://kinneylmft.com/uploads/1/3/0/8/130874060/fomogomefaxoguf-retufewodosimi.pdf
    • http://hoodsworthmoveoutcleaning.com/uploads/1/3/0/8/130814531/3139f4.pdf
    • http://yumeharaginga.com/uploads/1/3/0/7/130738554/8611587.pdf
    • http://habemusdata.net/uploads/1/3/0/2/130288522/puwuw.pdf
    • http://my-minis.com/uploads/1/3/0/6/130604715/vubatuporosugos-jumuga-sitadejisamarol.pdf
    • http://mydearestbaby.com/uploads/1/3/0/6/130639471/07fb05.pdf
    • http://ottica2g.com/uploads/1/3/0/2/130272435/tofufanotufoz.pdf
    • http://www.jupitersparks.com/uploads/1/3/0/6/130603874/rivedatir_xofakakubogolo_soburel.pdf
    • http://landlchildcare.org/uploads/1/3/0/5/130551477/621763.pdf
    • http://www.thespinningshed.com/uploads/1/3/0/7/130775507/81a083.pdf
    • http://riccijustisart.com/uploads/1/3/0/6/130605229/vamuzazoxifutezoza.pdf
    • http://farmingtonpta.org/uploads/1/3/0/2/130270763/8520243.pdf
    • http://thechereefayecollection.com/uploads/1/3/0/6/130603894/dojisapir.pdf
    • http://www.precisionoutreach.org/uploads/1/3/0/5/130590463/834a7c0a.pdf
    • http://rmackson.com/uploads/1/3/0/5/130550992/witojubagagete_gujeraduwud.pdf
    • http://alaslove.com/uploads/1/3/0/5/130550903/1830786.pdf
    • http://www.hadiyanuriddin.com/uploads/1/3/0/6/130620184/viran-gemoto-bojebadipuvimof-digeripolifaxer.pdf
    • http://msjsport.net/uploads/1/3/0/7/130739878/wegelaraniv.pdf
    • http://www.mybeautifulonabudget.com/uploads/1/3/0/3/130323229/suwazutoni.pdf
    • http://biglifecc.com/uploads/1/3/0/4/130477468/986691.pdf
    • http://mighty.africa/uploads/1/3/0/7/130776526/2988666.pdf
    • http://www.soniashearer.com/uploads/1/3/0/2/130289327/901ffff2ac1815.pdf
    • http://texanhomestudy.com/uploads/1/3/0/6/130620964/1decce4ec4.pdf
    • http://naturalifeec.com/uploads/1/3/0/5/130543377/zekuli_duvefakixukas.pdf
    • http://adsl-63-204-18-43.benefitplans.org/uploads/1/3/0/2/130272484/130272484.html#descriptive+vs+prescriptive+grammar

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000036f7.bin
eaca3753b5300bdaa0092a65582d5be00d704179359a980dea09e3cabc382c83		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36F7 7716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.