Malicious PDF — malware analysis report

Static analysis result for SHA-256 98e4b5e6976879de…

MALICIOUS

PDF

40.7 KB Authoring application: Karbon
MD5: 49b1b8c727ce983eb5da33722cde0649 SHA-1: f2a78286e117b2d1443549eb1bb8bdcb1d5f7c84 SHA-256: 98e4b5e6976879de6bd018a6e2db85d6a73dfddf51c90fd3de5154dec18cf078
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files across various domains. This pattern is indicative of a link farm or a mechanism to distribute malicious content or manipulate search engine results. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://angeliquedeclercq.be/uploads/1/3/0/5/130551127/69cc89fd26a8968.pdf
    • http://molliemonahan.com/uploads/1/3/0/3/130323547/aa97c783da4a.pdf
    • http://570dj.com/uploads/1/3/0/5/130544226/solamitulaxevatove.pdf
    • http://screenlo.com/uploads/1/3/0/6/130620601/9445864.pdf
    • http://natashastraley.com/uploads/1/3/0/7/130739204/c54e408.pdf
    • http://nzps2019.nz/uploads/1/3/0/5/130543173/vimepibekarar.pdf
    • http://michellesusanmarketing.com/uploads/1/3/0/4/130488946/715888b6c49.pdf
    • http://911bailbondsla.com/uploads/1/3/0/5/130590126/525f55cf89f2.pdf
    • http://miamipwcparts.com/uploads/1/3/0/5/130550762/mogupenusegekomides.pdf
    • http://balance-buddies.com/uploads/1/3/0/6/130640220/wolegum.pdf
    • http://joga.strahovanie61.ru/uploads/2020/01/29/297bca8e.pdf
    • http://cityonloc.com/uploads/1/3/0/2/130289498/130289498.html#chamara+weerasinghe+new+song+2019

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000128e.bin
a4d584817cc521bbba2e09de2249284f0e1f57273fb8c6c6483b99ff3500c3ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128E 8136 bytes
font_01_sfnt_off00005626.bin
0e776d34d15fdb39b883b6f4d287c545de2de0f1360dbfc09fdc3401076a0672		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5626 7248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.