Malicious PDF — malware analysis report

Static analysis result for SHA-256 86eebe67819fe869…

MALICIOUS

PDF

48.3 KB Authoring application: Karbon First seen: 2020-09-24
MD5: acd3ada7e18a1d471c9d2ed00f2f7b85 SHA-1: 2b682a8b7cfffb504784c77fb81fdad987275531 SHA-256: 86eebe67819fe8697756f406bcd9c114229934b5e19ad31538fb013ba8021909
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical rule indicating a mass external PDF link farm. The embedded URLs suggest a tactic to redirect users to a large number of other PDF documents, likely for SEO manipulation or to host malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ldsstrangite.org/uploads/1/3/0/5/130539016/raxobidow-laxub-wegivivod-kusakebanajut.pdf In PDF document text
    • http://mypups4u.com/uploads/1/3/0/2/130271078/8cc2edff9.pdfIn PDF document text
    • http://zeg.coachesportivo.com/uploads/2020/01/27/koxav_gawogigopevi_fopajujufulema_sujex.pdfIn PDF document text
    • https://kuguludoguwagi.weebly.com/uploads/1/3/0/2/130289478/jaxelorupulowudefuwa.pdfIn PDF document text
    • http://euvat.solutions/uploads/1/3/0/6/130639493/nerubok.pdfIn PDF document text
    • http://veb.icgauthbanquepoportail.com/uploads/2020/01/29/rixapeke.pdfIn PDF document text
    • http://ninefortyfilms.com/uploads/1/3/0/5/130543262/perufipapino_puzekadafu_lujovomag_vaputafukat.pdfIn PDF document text
    • http://cookingwithpolygons.com/uploads/1/3/0/5/130551941/1799981.pdfIn PDF document text
    • http://jet.secondlives.biz/uploads/2020/01/28/e43312e.pdfIn PDF document text
    • http://artispira.com/uploads/1/3/0/5/130543106/1f9cff5c6369a8.pdfIn PDF document text
    • http://gaz-shop.com/uploads/2020/01/29/4327744.pdfIn PDF document text
    • http://rateyouthsports.com/uploads/1/3/0/6/130621677/refux.pdfIn PDF document text
    • http://niwiniri.optomsahar.ru/uploads/2020/01/27/mowuwusex-xemuzonug-guxut.pdfIn PDF document text
    • http://aaadentalbahamas.com/uploads/1/3/0/4/130489066/vamofufa-bijemuxekepu-bolakobo.pdfIn PDF document text
    • http://adriantobin.com/uploads/1/3/0/3/130379163/xixoj-mevijudu.pdfIn PDF document text
    • http://bubemeviku.seubluray.com/uploads/2020/01/27/0cafff.pdfIn PDF document text
    • http://sunburstmusic.org/uploads/1/3/0/4/130435738/wokowazewalufujite.pdfIn PDF document text
    • http://prettylittlethings.ca/uploads/1/3/0/4/130476678/nofefaxikuworetexu.pdfIn PDF document text
    • http://automaticpocketdoor.com/uploads/1/3/0/6/130639251/8299503.pdfIn PDF document text
    • http://spatzen.hu/uploads/1/3/0/5/130589165/jezudomojur-potas.pdfIn PDF document text
    • http://tosobe.prorealgames.com/uploads/2020/01/28/jimuperog.pdfIn PDF document text
    • http://theelfbox.com/uploads/1/3/0/4/130476079/130476079.html#cooch+behar+weather+reportIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001948.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1948 11200 bytes
SHA-256: 8deea64082ff93b68c09d95949f8dd39ac4e609e508ecde78e0cb5c1b9a53996
font_01_sfnt_off00006b94.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B94 2652 bytes
SHA-256: e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc
font_02_sfnt_off00007487.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7487 16452 bytes
SHA-256: cbe7a62b69fdb922f8f163d67e74915eaff952d21b2fe13d67c0a71899693a57

Open this report in the interactive analyzer, or submit your own file for analysis.