Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d94f515a132c069…

MALICIOUS

PDF

62.6 KB Authoring application: Karbon First seen: 2020-09-24
MD5: 10734143bdf009af4c4a9cf249c2e5b6 SHA-1: 8038d8b2d35c64c0800377b24d8909116183ac7c SHA-256: 6d94f515a132c06953e2c55985d076740684f144c4f6d13ad1abd4581569d499
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, specifically as a phishing or robot-install type. The embedded URLs likely lead to further malicious content or phishing pages, and the document body's garbled nature suggests it's not intended for human consumption but rather for exploitation or SEO manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://selfsciencelabs.com/uploads/1/3/0/4/130478244/7c540061135a89.pdf In PDF document text
    • http://stevenandstacee.com/uploads/1/3/0/9/130969503/908089.pdfIn PDF document text
    • http://holsombaby.com/uploads/1/3/0/2/130287553/0b96d.pdfIn PDF document text
    • http://sakarasjourneys.com/uploads/1/3/0/8/130873957/nedirenewu_fusijiwavokeji_memagirunevasux.pdfIn PDF document text
    • http://ocwpublishing.com/uploads/1/3/0/6/130604808/7424524.pdfIn PDF document text
    • http://handiletter.com/uploads/1/3/0/7/130776898/6134664.pdfIn PDF document text
    • http://daughtersofthenewrevolution.org/uploads/1/3/0/6/130604731/12611695f1b8.pdfIn PDF document text
    • http://barrons-independent.com/uploads/1/3/0/8/130814576/5845cb195a7a452.pdfIn PDF document text
    • http://myeclecticyoga.com/uploads/1/3/0/2/130288554/buterepuvenon.pdfIn PDF document text
    • http://elianaserato.com/uploads/1/3/0/5/130551896/b73f13d50dbaf2f.pdfIn PDF document text
    • http://crownway.org/uploads/1/3/0/6/130621488/19261110afa92.pdfIn PDF document text
    • http://candycares.net/uploads/1/3/0/4/130435927/5336889.pdfIn PDF document text
    • http://contractlawtraining.com/uploads/1/3/0/5/130551198/perituzuzefokufawo.pdfIn PDF document text
    • http://accomplishquiltingmail.com/uploads/1/3/0/4/130489090/juwem.pdfIn PDF document text
    • http://eo90w.bpmtc.com/uploads/1/3/0/5/130589371/130589371.html#prove+that+energy+finite+abelian+group+is+the+direct+product+of+cyclic+groupsIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
🗂 Part of campaign: 3505brunell.net 8 samples

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005e3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E3F 4156 bytes
SHA-256: 92960e0e807263a12bad55ec69bafb6714c32758af60e957fa6a07630d5d1445
font_01_sfnt_off00006b24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B24 16956 bytes
SHA-256: d7a86f227248f9ddf8ba13d841e8e58f38ae2adf2f5f3e927f3b084637260bf2
font_02_sfnt_off00008325.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8325 4632 bytes
SHA-256: 711ca9ea05c99afe6ee9021edfee920139ad8caab5bb3899d3d39463fe4a614f
font_03_sfnt_off000095fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x95FE 9916 bytes
SHA-256: 698d156b2357c224473bdcfabc27e485853f8b306c69e67ec42e0d4389f7fc4c

Open this report in the interactive analyzer, or submit your own file for analysis.