Malicious PDF — malware analysis report

Static analysis result for SHA-256 6cc0ec040d255fa5…

MALICIOUS

PDF

43.0 KB Authoring application: Karbon First seen: 2020-09-24
MD5: f6d3ffe068e1f290c7a5dd14fdcfa707 SHA-1: baf0ae97864855eb5326a883ccff35bf9c7fa24e SHA-256: 6cc0ec040d255fa50982e982daadb445daeee3a270e0ace8eaa67e70943c3d1f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 and the ML classifier output strongly suggest malicious intent. The embedded URLs are likely used to distribute further malicious content or for SEO spamming.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hblogix.com/uploads/1/3/0/6/130621068/824713.pdf In PDF document text
    • http://puppyregistrationpapers.com/uploads/1/3/0/6/130621461/xubaxugapiwuz-jakuvoxumiw.pdfIn PDF document text
    • http://sopela.fazenda2.ru/uploads/2020/01/28/todubixudiw.pdfIn PDF document text
    • http://gepilak.baksmans.club/uploads/2020/01/27/tatejixejafefud-getewovorejegap.pdfIn PDF document text
    • http://joduxe.letstakemetoad.com/uploads/2020/01/29/xureneramubako.pdfIn PDF document text
    • http://kaba.pochka.info/uploads/2020/01/27/zolasuwotu.pdfIn PDF document text
    • http://markbarun.com/uploads/2020/01/27/bubopamidororokudu.pdfIn PDF document text
    • http://buildyourbody.online/uploads/1/3/0/2/130289738/099dc2ff2c47.pdfIn PDF document text
    • http://masterlibrary-staging.com/uploads/1/3/0/4/130476346/4ceeceed.pdfIn PDF document text
    • http://fuz.pansionat-chaika.com/uploads/2020/01/29/384e60495605.pdfIn PDF document text
    • http://atimer.net/uploads/2020/01/28/239418.pdfIn PDF document text
    • http://lutavuteg.populair-cyber.com/uploads/2020/01/27/ae3dd1.pdfIn PDF document text
    • http://zenoru.macronbit.com/uploads/2020/01/27/1129a934b.pdfIn PDF document text
    • http://bartschcchs.com/uploads/1/3/0/4/130489038/furufibokebixigil.pdfIn PDF document text
    • http://japservicesllc.com/uploads/1/3/0/2/130291702/4961312.pdfIn PDF document text
    • http://danhixsonphotography.com/uploads/1/3/0/2/130271031/giziribovovasilawu.pdfIn PDF document text
    • http://pibhortolandia.org/uploads/2020/01/27/zanijugerus-juniv.pdfIn PDF document text
    • http://3dwear.ph/uploads/1/3/0/2/130272932/2371231.pdfIn PDF document text
    • http://harveyjettmusic.com/uploads/1/3/0/2/130272886/1473375.pdfIn PDF document text
    • http://toma.accessory-app.com/uploads/2020/01/29/dc24cdc5b2.pdfIn PDF document text
    • http://sadaxix.stoneprocessingtool.ru/uploads/2020/01/29/jozipixu_kinirunale_gekebifa_ridexa.pdfIn PDF document text
    • http://mununek.csgowins.pw/uploads/2020/01/27/pawerop-ridazof-mumusijifa-moduzupazu.pdfIn PDF document text
    • http://vedix.nemcolombia.com/uploads/2020/01/27/79aac31b88.pdfIn PDF document text
    • http://lhfieldfamilyfdn.org/uploads/1/3/0/4/130483265/pewukalup.pdfIn PDF document text
    • http://misbailes.com/uploads/1/3/0/2/130291596/130291596.html#dhaker+bajna+durga+puja+freeIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000058cb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x58CB 18840 bytes
SHA-256: b514fd8cc63ad9e749f69936230c1c2bf0773f94f5441a32f3e393ebf7cffcfc
font_00_sfnt_off000016dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16DC 7688 bytes
SHA-256: 5e6b080f905d4f6e1d823fb21d4e683393cb16a5c65cdd830995b0f3244f4f21

Open this report in the interactive analyzer, or submit your own file for analysis.