Malicious PDF — malware analysis report

Static analysis result for SHA-256 691f3888d6631a86…

MALICIOUS

PDF

48.9 KB Authoring application: Karbon
MD5: a0491844a5159d97e1815dda75c3e3f6 SHA-1: b9b8087e550f837b84564b9ca51b280430286ce9 SHA-256: 691f3888d6631a8679cde4a62c8138c27777deda76cf917be0067ef8c216af72
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical alert for a large number of external PDF links, suggesting a link farm designed to redirect users. The ML classifier and ClamAV also identified it as malicious. The embedded URLs likely lead to further malicious content or phishing pages, and the document body contains obfuscated text and numerous URLs pointing to external PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tabithasdesigns.org/uploads/1/3/0/2/130272484/likenupobisa.pdf
    • http://neverreacttohate.com/uploads/1/3/0/2/130289480/aa2825d.pdf
    • http://mountainviewconcreteco.com/uploads/1/3/0/6/130603773/5628595.pdf
    • http://325986690869568534.com/uploads/1/3/0/2/130291922/594057.pdf
    • http://kent-brushes.com/uploads/1/3/0/6/130639616/fomojofosodup.pdf
    • http://nwlaautomationgroup.com/uploads/1/3/0/2/130289265/foxugowumifodufamof.pdf
    • http://petersonskattumrealtygroup.com/uploads/1/3/0/2/130289601/cb48593dd.pdf
    • http://northparkvoicestudio.com/uploads/1/3/0/5/130546497/4b2a07cef4.pdf
    • https://zefubesejituw.weebly.com/uploads/1/3/0/6/130605448/duvow-giludinozusixe-xixez.pdf
    • http://boltkomplekt.ru/uploads/2020/01/28/sikomudewa_murup_labisurekatune.pdf
    • http://nursingarmpillow.com/uploads/1/3/0/4/130476255/130476255.html#adanam+ma+hada+song+video
    • http://sinhala.sourceforge.net/
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
    • http://www.gnu.org/licenses/gpl-2.0.html

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012b4.bin
2417a32bd66ae2f6ad40b1314497aa52c18319c3ea16de64d3154cfa4fa91bb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B4 8488 bytes
font_01_sfnt_off00006968.bin
5a3357e484f29093223472a2c8a2409243da3d36574dfd15aed9f8ad6ade28c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6968 13448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.