Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b91869d25f974de…

MALICIOUS

PDF

60.3 KB Authoring application: Karbon
MD5: 40872bb4d7c05b76b15235ba698ffb4c SHA-1: bafdf75ee0f0782a1f4d42e149c4c4b2011863b7 SHA-256: 6b91869d25f974deab1f9b3802b1bdfba77e3c6a1c45a4c1bfefd00a52e857c3
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file exhibits a critical heuristic for a link farm, containing numerous external links to other PDF files, suggesting a phishing or malware distribution campaign. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports malicious intent. The embedded URLs likely serve as lures to download further malicious content or redirect to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://my-chat-random-thoughts.club/uploads/1/3/0/2/130288673/67423844185.pdf
    • http://rebylez.store/uploads/1/3/0/6/130621868/fulibaxamimepu.pdf
    • http://desatascosmolletdelvalles.com/uploads/1/3/0/4/130483990/2693632.pdf
    • http://thecardr.net/uploads/1/3/0/6/130639924/6897317.pdf
    • http://telos.studio/uploads/1/3/0/7/130776164/lifawizagowinugadagi.pdf
    • http://caskmutation.org/uploads/1/3/0/6/130620454/1794967.pdf
    • http://www.creativecatphotography.com/uploads/1/3/0/5/130539757/6428683.pdf
    • http://eatlocalexpokc.com/uploads/1/3/0/5/130546742/wezujudakizamu.pdf
    • http://www.rusticallyrefined.com/uploads/1/3/0/5/130588614/kozisitexuwax-munasosu-kosoxixebitol-serikari.pdf
    • http://mta-sts.mx.educationinspired.com/uploads/1/3/0/5/130539004/51d7e85ca5daa.pdf
    • http://aakyoga.com/uploads/1/3/0/4/130483817/4944586.pdf
    • http://vestmoglobal.com/uploads/1/3/0/7/130739218/df26f768fd.pdf
    • http://juliayarnshop.com/uploads/1/3/0/8/130874063/76ec7.pdf
    • http://millenialpages.com/uploads/1/3/0/5/130545885/zikadasatugawu.pdf
    • http://333tools.com/uploads/1/3/0/4/130479435/848a0b.pdf
    • http://rgrenovation.com/uploads/1/3/0/8/130813787/5941b5c34e.pdf
    • http://letuscallforyou.com/uploads/1/3/0/8/130814020/benaragilam.pdf
    • http://beautificationonline.com/uploads/1/3/0/2/130289399/zilifubolagumaf.pdf
    • http://richter-family.rominastiebenphotography.com/uploads/1/3/0/3/130323599/130323599.html#10th+new+syllabus+sura+guide+download
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003fb4.bin
2950d87d769d79d0d16faf16dcd761b2c0673d4bd237e761afb1007449cc6e80		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3FB4 1852 bytes
font_01_sfnt_off00004852.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4852 16036 bytes
font_02_sfnt_off00005e4b.bin
0388e3e2e3f67a30fc0e30f31c4f5c516c056a6da6937f0c96997f146d2616b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E4B 17604 bytes
font_03_sfnt_off00008f1f.bin
1755074b0b7b00fb7c5350f2eb60469a73d42b68faaca49abcbb9702015801d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F1F 7692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.