Malicious PDF — malware analysis report

Static analysis result for SHA-256 8df131ea475fb25d…

MALICIOUS

PDF

42.0 KB Authoring application: Karbon First seen: 2020-09-24
MD5: f3c5c6fbfa967714f771e575e0c840de SHA-1: be94cd68c05648326cadb2474c71c8420b69109d SHA-256: 8df131ea475fb25d994e7e1e3609cdb41a27a8f0b42d130c07408a9131b29f99
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this file as Pdf.Phishing.TtraffRobotInstall-7605656-0, suggesting a phishing or traffic redirection intent. The ML classifier strongly agrees with the malicious verdict. The primary attack pattern involves redirecting users to a vast array of external PDF documents hosted on numerous domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ay-kay.com/uploads/1/3/0/2/130272424/91d27c97ac03.pdf In PDF document text
    • http://metrogovernance.com/uploads/1/3/0/5/130588546/gazapupig.pdfIn PDF document text
    • http://www.my800waterdamage.com/uploads/1/3/0/7/130775215/movokutuveviko.pdfIn PDF document text
    • http://idutur.org/uploads/1/3/0/8/130873983/jexasuwawesifo.pdfIn PDF document text
    • http://sylteszeri.com/uploads/1/3/0/2/130289799/vejupasojolaw-kubusubob-turupol.pdfIn PDF document text
    • http://notforprophet.net/uploads/1/3/0/5/130551464/9281361.pdfIn PDF document text
    • http://anitaleverarttherapist.com/uploads/1/3/0/4/130477490/1959871c9a8.pdfIn PDF document text
    • http://westcoastkittens.com/uploads/1/3/0/3/130323157/3465808.pdfIn PDF document text
    • http://www.envoyclaimsolutions.com/uploads/1/3/0/6/130603853/9023094.pdfIn PDF document text
    • http://www.housemusicyorkshire.co.uk/uploads/1/3/0/6/130639385/c94d01a40517.pdfIn PDF document text
    • http://dayscreekschools.com/uploads/1/3/0/5/130543261/9564646.pdfIn PDF document text
    • http://ssjo.org/uploads/1/3/0/6/130639776/nesimekekujaju_wupinoduxi.pdfIn PDF document text
    • http://michalpaczkowski.com/uploads/1/3/0/4/130476572/wesomafenubero.pdfIn PDF document text
    • http://multiples.media/uploads/1/3/0/7/130776760/e70cb9d305f.pdfIn PDF document text
    • http://essteamlab.com/uploads/1/3/0/2/130289493/kijajilebolu.pdfIn PDF document text
    • http://3mdentallab.com/uploads/1/3/0/6/130621212/e653cac5e4d81.pdfIn PDF document text
    • http://sydneycornerstone.org/uploads/1/3/0/7/130776385/ruvedusaxep.pdfIn PDF document text
    • http://www.tagdogtraining.com/uploads/1/3/0/7/130738837/kamek.pdfIn PDF document text
    • http://managedservicessacramento.support/uploads/1/3/0/6/130604090/4260bfc826.pdfIn PDF document text
    • http://doodlebugblessingsgoldendoodles.com/uploads/1/3/0/2/130271019/fibufifufakoru_sukogavekofi_rabibal.pdfIn PDF document text
    • http://crhardscape.com/uploads/1/3/0/2/130272086/7239539.pdfIn PDF document text
    • http://angstmanartistry.com/uploads/1/3/0/4/130483513/8aef22f027a9.pdfIn PDF document text
    • http://sheriahernphotography.com/uploads/1/3/0/5/130544243/meradaxipu-dewawawo-taxufezubalere.pdfIn PDF document text
    • http://saintjameslakecity.org/uploads/1/3/0/6/130639270/rojejifatiduvaf_jadajuzaze_zejenemuma.pdfIn PDF document text
    • http://peterclaytonwriter.com/uploads/1/3/0/5/130589048/8591367.pdfIn PDF document text
    • http://royal1688.lucky1st.com/uploads/1/3/0/7/130776182/130776182.html#secondary+prophylaxis+for+rheumatic+feverIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003334.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3334 2864 bytes
SHA-256: 6dc6e07f93ae70488a19e8a398a1c6cda2f5723fc3d3cbe180c5afbb10c3611e
font_01_sfnt_off00003fbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FBC 7788 bytes
SHA-256: 123595519f13b9f524da6f51a7df1e27bf12758c0fc958ec62eb8919968f4cb0

Open this report in the interactive analyzer, or submit your own file for analysis.