Malicious PDF — malware analysis report

Static analysis result for SHA-256 803fdf08473f2adc…

MALICIOUS

PDF

42.3 KB Authoring application: Karbon
MD5: 8ab19a5a83097bd2b556c07ae2791502 SHA-1: 4cc67fd675376453dbec2e7003b050aa22b43690 SHA-256: 803fdf08473f2adc4dee887de4c3f42d16ad68bb54563f61f81f90e6564f4c6b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links likely lead to phishing pages or malware downloads. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://asiaoutdoors.com.vn/uploads/1/3/0/2/130289291/mupezatopotefekizoj.pdf
    • http://nyanyaekaterinburg.ru/uploads/1/3/0/6/130639745/4d5a522572ea.pdf
    • http://stagcroatia.net/uploads/1/3/0/8/130814192/a295c.pdf
    • http://pciprimer.com/uploads/1/3/0/7/130775379/buvubawaro-xedukusaka.pdf
    • http://mindfulnesswelcome.com/uploads/1/3/0/6/130639883/72a31452fb.pdf
    • http://vladimirgarzacirco.com/uploads/1/3/0/4/130476816/zateniruwa.pdf
    • http://animspree.com/uploads/1/3/0/2/130291699/gewuwe-xuwonelape-darozemijugero-numaz.pdf
    • http://www.carouselmusictheatre.org/uploads/1/3/0/2/130272232/1eda89bc3.pdf
    • http://seodublin.org/uploads/1/3/0/4/130488282/5daa718f840.pdf
    • http://harvestleaders.org/uploads/1/3/0/6/130621509/vavide.pdf
    • http://allabouthimministriessc.com/uploads/1/3/0/6/130621238/f3ca8d84.pdf
    • http://www.slofindinghope.com/uploads/1/3/0/5/130590482/vexibi_buvamirikal.pdf
    • http://basaltto.com/uploads/1/3/0/5/130551378/344596c20131e49.pdf
    • http://www.theluckyfewbooksandfundraising.com/uploads/1/3/0/5/130588202/4c192574e.pdf
    • http://angryselfloathingbabies.net/uploads/1/3/0/6/130639709/tusefe.pdf
    • http://www.dogwalkersilford.com/uploads/1/3/0/8/130874580/717ec865b.pdf
    • http://ramsen.com/uploads/1/3/0/7/130776788/kopejerifivuvo.pdf
    • http://woodcanners.com/uploads/1/3/0/7/130739779/8117787.pdf
    • http://victoriajsmith.com/uploads/1/3/0/6/130640114/4241224.pdf
    • http://patrickjbryan.com/uploads/1/3/0/2/130288511/80c46e09b2d8.pdf
    • http://benkregel.com/uploads/1/3/0/3/130323424/130323424.html#wii+theme+song+piano+sheet+music
    • http://animspree.com/uploads/1/3/0/2/130291699/gewuwe-xuwonelape-darozemijugero-numaz.pd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000044f0.bin
43b5fd30bc5ca54e2e29c39393b9baed240d8f93b2483e14ec695a0c0c6fd836		 pdf-font-stream PDF embedded font (sfnt) at offset 0x44F0 9076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.