PDF malware analysis — malicious · 6d94f515a132c069

MALICIOUS

PDF

62.6 KB Authoring application: Karbon

MD5: 10734143bdf009af4c4a9cf249c2e5b6 SHA-1: 8038d8b2d35c64c0800377b24d8909116183ac7c SHA-256: 6d94f515a132c06953e2c55985d076740684f144c4f6d13ad1abd4581569d499

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, specifically as a phishing or robot-install type. The embedded URLs likely lead to further malicious content or phishing pages, and the document body's garbled nature suggests it's not intended for human consumption but rather for exploitation or SEO manipulation.

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://selfsciencelabs.com/uploads/1/3/0/4/130478244/7c540061135a89.pdf
- http://stevenandstacee.com/uploads/1/3/0/9/130969503/908089.pdf
- http://holsombaby.com/uploads/1/3/0/2/130287553/0b96d.pdf
- http://sakarasjourneys.com/uploads/1/3/0/8/130873957/nedirenewu_fusijiwavokeji_memagirunevasux.pdf
- http://ocwpublishing.com/uploads/1/3/0/6/130604808/7424524.pdf
- http://handiletter.com/uploads/1/3/0/7/130776898/6134664.pdf
- http://daughtersofthenewrevolution.org/uploads/1/3/0/6/130604731/12611695f1b8.pdf
- http://barrons-independent.com/uploads/1/3/0/8/130814576/5845cb195a7a452.pdf
- http://myeclecticyoga.com/uploads/1/3/0/2/130288554/buterepuvenon.pdf
- http://elianaserato.com/uploads/1/3/0/5/130551896/b73f13d50dbaf2f.pdf
- http://crownway.org/uploads/1/3/0/6/130621488/19261110afa92.pdf
- http://candycares.net/uploads/1/3/0/4/130435927/5336889.pdf
- http://contractlawtraining.com/uploads/1/3/0/5/130551198/perituzuzefokufawo.pdf
- http://accomplishquiltingmail.com/uploads/1/3/0/4/130489090/juwem.pdf
- http://eo90w.bpmtc.com/uploads/1/3/0/5/130589371/130589371.html#prove+that+energy+finite+abelian+group+is+the+direct+product+of+cyclic+groups
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.adobe.com/).Noto
- http://www.google.com/get/noto/http://www.adobe.com/type/This
- http://scripts.sil.org/OFLNoto
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005e3f.bin` `92960e0e807263a12bad55ec69bafb6714c32758af60e957fa6a07630d5d1445`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E3F	4156 bytes
`font_01_sfnt_off00006b24.bin` `d7a86f227248f9ddf8ba13d841e8e58f38ae2adf2f5f3e927f3b084637260bf2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B24	16956 bytes
`font_02_sfnt_off00008325.bin` `711ca9ea05c99afe6ee9021edfee920139ad8caab5bb3899d3d39463fe4a614f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8325	4632 bytes
`font_03_sfnt_off000095fe.bin` `698d156b2357c224473bdcfabc27e485853f8b306c69e67ec42e0d4389f7fc4c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x95FE	9916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.