Malicious PDF — malware analysis report

Static analysis result for SHA-256 91ba23b050f9fff8…

MALICIOUS

PDF

50.0 KB Authoring application: Karbon
MD5: 0e2293dec08deba94e8f924603c4c1c7 SHA-1: 309ef6d8534023e436876eb16172113766cc1697 SHA-256: 91ba23b050f9fff82bfbdfa05250db300d82d4c0f5f58bc0f0a7d7ca09f69463
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to other PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary URL, http://cakenetwork.us/uploads/1/3/0/3/130379368/7407047.pdf, is part of this link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cakenetwork.us/uploads/1/3/0/3/130379368/7407047.pdf
    • https://wonamepulowoda.weebly.com/uploads/1/3/0/5/130551659/21da4cd73350b8.pdf
    • http://painfulhipresurfacing.com/uploads/1/3/0/2/130272582/tetal_kuwelal.pdf
    • http://lasvegasbombers.com/uploads/1/3/0/2/130287229/dejonipowijasu.pdf
    • http://cfthomas.com/uploads/1/3/0/6/130639242/vofakarowigixebe.pdf
    • http://mylittletruffles.com/uploads/1/3/0/6/130604950/c8cd27.pdf
    • http://newoutsiderart.com/uploads/1/3/0/4/130483833/pevodagupupalar.pdf
    • http://cradleinferno.com/uploads/1/3/0/7/130739284/fivawodevazav.pdf
    • http://meredithlubowphd.com/uploads/1/3/0/6/130604424/0d630ba6d1.pdf
    • http://mercadohuanacaxtle.com/uploads/1/3/0/6/130604905/bovuni.pdf
    • http://thehnossaproject.com/uploads/1/3/0/3/130313299/130313299.html#recovery+for+hip+labrum+tear

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001307.bin
ff05724657b7fb8a7a617e58f40e271411170d644b65909c85cbbabe6a716d1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1307 9728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.