Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c6c77edfe88a8c9…

MALICIOUS

PDF

36.4 KB Authoring application: Karbon
MD5: 072fd12cf5639d2a4dc0f1d72969f98a SHA-1: 06bedec2691aa0301865f5ce609554eb8d5d8e8f SHA-256: 7c6c77edfe88a8c95c0e3e846d423916ec96a884c3f4dffa8db5511831c2b439
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a link farm. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or distributing further malware. The embedded URLs are the primary IOCs, suggesting a campaign to drive traffic to potentially compromised or malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mountainvilleumc.com/uploads/1/3/0/3/130379422/f36b0c01ccc4.pdf
    • http://pluralform.se/uploads/1/3/0/2/130271184/bofatamalizuze-jileligimanas-kowebevokevo.pdf
    • http://vobozid.svyazexpo-online.ru/uploads/2020/01/28/bulusekazoxepuvawiv.pdf
    • http://babuxe.vipiski-online6.icu/uploads/2020/01/29/478d67771.pdf
    • http://cornwall2theandes.com/uploads/1/3/0/2/130288768/tobokemirimasina.pdf
    • http://blockchaincommoditiesexchangeltd.com/uploads/1/3/0/2/130272328/fesugepujodudab.pdf
    • http://uniontradebank.com/uploads/2020/01/28/tonomugogixe-lujew-gerenutuk-diwerekemo.pdf
    • http://xesuxe.click5link.com/uploads/2020/01/29/roledaruv-nuxasewimoduze-fibamo.pdf
    • http://rayonlifestyle.com/uploads/1/3/0/6/130604372/17985e.pdf
    • https://ditazolun.weebly.com/uploads/1/3/0/2/130289386/jepitojirawe_galex_kekupil_tenadomeb.pdf
    • http://quran-media.online/uploads/2020/01/29/5ab94013e3b60d.pdf
    • http://anomalija.com/uploads/2020/01/29/5684010.pdf
    • http://cherrybrookmusic.weebly.com/uploads/1/3/0/4/130483286/af1f5805df.pdf
    • http://daj.rentaprice.ru/uploads/2020/01/27/da8e06d5daf19.pdf
    • http://miracleinabucket.com/uploads/1/3/0/5/130551219/130551219.html#blank+bar+graph+worksheets+2nd+grade

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000143c.bin
bf880aa3b7194d8bcbdea511ce3e3a5d2d6b4caa74350a9c88df47e2c2229e25		 pdf-font-stream PDF embedded font (sfnt) at offset 0x143C 8140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.