Malicious PDF — malware analysis report

Static analysis result for SHA-256 86eebe67819fe869…

MALICIOUS

PDF

48.3 KB Authoring application: Karbon
MD5: acd3ada7e18a1d471c9d2ed00f2f7b85 SHA-1: 2b682a8b7cfffb504784c77fb81fdad987275531 SHA-256: 86eebe67819fe8697756f406bcd9c114229934b5e19ad31538fb013ba8021909
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical rule indicating a mass external PDF link farm. The embedded URLs suggest a tactic to redirect users to a large number of other PDF documents, likely for SEO manipulation or to host malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ldsstrangite.org/uploads/1/3/0/5/130539016/raxobidow-laxub-wegivivod-kusakebanajut.pdf
    • http://mypups4u.com/uploads/1/3/0/2/130271078/8cc2edff9.pdf
    • http://zeg.coachesportivo.com/uploads/2020/01/27/koxav_gawogigopevi_fopajujufulema_sujex.pdf
    • https://kuguludoguwagi.weebly.com/uploads/1/3/0/2/130289478/jaxelorupulowudefuwa.pdf
    • http://euvat.solutions/uploads/1/3/0/6/130639493/nerubok.pdf
    • http://veb.icgauthbanquepoportail.com/uploads/2020/01/29/rixapeke.pdf
    • http://ninefortyfilms.com/uploads/1/3/0/5/130543262/perufipapino_puzekadafu_lujovomag_vaputafukat.pdf
    • http://cookingwithpolygons.com/uploads/1/3/0/5/130551941/1799981.pdf
    • http://jet.secondlives.biz/uploads/2020/01/28/e43312e.pdf
    • http://artispira.com/uploads/1/3/0/5/130543106/1f9cff5c6369a8.pdf
    • http://gaz-shop.com/uploads/2020/01/29/4327744.pdf
    • http://rateyouthsports.com/uploads/1/3/0/6/130621677/refux.pdf
    • http://niwiniri.optomsahar.ru/uploads/2020/01/27/mowuwusex-xemuzonug-guxut.pdf
    • http://aaadentalbahamas.com/uploads/1/3/0/4/130489066/vamofufa-bijemuxekepu-bolakobo.pdf
    • http://adriantobin.com/uploads/1/3/0/3/130379163/xixoj-mevijudu.pdf
    • http://bubemeviku.seubluray.com/uploads/2020/01/27/0cafff.pdf
    • http://sunburstmusic.org/uploads/1/3/0/4/130435738/wokowazewalufujite.pdf
    • http://prettylittlethings.ca/uploads/1/3/0/4/130476678/nofefaxikuworetexu.pdf
    • http://automaticpocketdoor.com/uploads/1/3/0/6/130639251/8299503.pdf
    • http://spatzen.hu/uploads/1/3/0/5/130589165/jezudomojur-potas.pdf
    • http://tosobe.prorealgames.com/uploads/2020/01/28/jimuperog.pdf
    • http://theelfbox.com/uploads/1/3/0/4/130476079/130476079.html#cooch+behar+weather+report
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001948.bin
8deea64082ff93b68c09d95949f8dd39ac4e609e508ecde78e0cb5c1b9a53996
pdf-font-stream PDF embedded font (sfnt) at offset 0x1948 11200 bytes
font_01_sfnt_off00006b94.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc
pdf-font-stream PDF embedded font (sfnt) at offset 0x6B94 2652 bytes
font_02_sfnt_off00007487.bin
cbe7a62b69fdb922f8f163d67e74915eaff952d21b2fe13d67c0a71899693a57
pdf-font-stream PDF embedded font (sfnt) at offset 0x7487 16452 bytes