Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b752fcd07fb0c3b…

MALICIOUS

PDF

33.7 KB Authoring application: Karbon
MD5: c4de3df75e9d0d7f8342f85f9507dec1 SHA-1: 5d9905c616fff0f54725d7bc6de8fc8262fdd921 SHA-256: 6b752fcd07fb0c3b0431970d61ea3be085a3b9978d89bbfbb8f39f9f025c3723
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection intent. No scripts were extracted from this sample, but the sheer volume of linked PDFs suggests a coordinated effort to drive traffic or distribute payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sergiolab.org/uploads/1/3/0/8/130813373/sagigikusowawiwuzoxe.pdf
    • http://geek-ishthings.com/uploads/1/3/0/3/130324357/tajerezuke-mugomo-defubofoze.pdf
    • http://flxyble.com/uploads/1/3/0/5/130543166/d948de6c5ce.pdf
    • http://ptcwyoming.com/uploads/1/3/0/4/130476574/6f7ed8.pdf
    • http://www.japonensemble.fr/uploads/1/3/0/5/130588165/padukuvasetaduf_sibuxipugijobad.pdf
    • http://fusionsalonsj.com/uploads/1/3/0/4/130488362/4628432.pdf
    • http://puzzlesandbraingames.com/uploads/1/3/0/7/130775831/6519196.pdf
    • http://autodiscover.keyconceptslearning.com/uploads/1/3/0/5/130588833/tugobaw.pdf
    • http://www.neilgeyette.com/uploads/1/3/0/2/130288511/ziseguzivan.pdf
    • http://orchc.com/uploads/1/3/0/6/130621656/2ec9b35edf.pdf
    • http://www.andrephilippephoto.net/uploads/1/3/0/6/130621101/tumenizexi.pdf
    • http://inkoutradio.net/uploads/1/3/0/5/130539393/7471443.pdf
    • http://www.weiwu1214.com/uploads/1/3/0/9/130968997/jigikuzop.pdf
    • http://it.samvadmusic.com/uploads/1/3/0/7/130776434/4613450.pdf
    • http://lakelifefashions.com/uploads/1/3/0/7/130775029/dadife_potupugidepapez_wovusom.pdf
    • http://kreativekidsworld.com/uploads/1/3/0/2/130272481/130272481.html#action+verbs+exercises+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002836.bin
3d1f22111b651fe6dbbabcf6a04d0e7d84baa6d0719534f199ae14e8c3f09be4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2836 8132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.