Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a90b9de2236a4e3…

MALICIOUS

PDF

40.6 KB Authoring application: Karbon
MD5: 8c0797cdd8c2d727c6621c904e30665a SHA-1: ca28ecfac8e0948e862a2be75d905a76b4d4484d SHA-256: 9a90b9de2236a4e354034993be4826e436c098e4e6a8a86b65406f91ad853825
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to various domains, indicative of a link farm or phishing campaign. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body, though heavily truncated and containing garbled text, includes references to medical treatments, potentially as a lure. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dollarwitch.com/uploads/1/3/0/6/130621579/63477.pdf
    • http://mrgatewoodcody.com/uploads/1/3/0/6/130620268/607f4c840.pdf
    • http://otherworldlyart.com/uploads/1/3/0/5/130588772/8140573.pdf
    • http://enticionote.com/uploads/1/3/0/5/130544136/likukoseraninufogog.pdf
    • http://tomwenfashiondesign.com/uploads/1/3/0/3/130323392/kegugetetizanogo.pdf
    • http://nwapetgrooming.com/uploads/1/3/0/6/130639026/2cb93b.pdf
    • http://fishtownshops.com/uploads/1/3/0/5/130550824/sagikegasafo_rubebijar_rujarala_kazanovuwisoz.pdf
    • http://caltempmissionb.org/uploads/1/3/0/5/130589002/nemizezofunu.pdf
    • http://safefromlymedisease.com/uploads/1/3/0/6/130604276/ac8377bd386eb.pdf
    • http://cassyjade.com/uploads/1/3/0/5/130588268/4750692.pdf
    • http://eindhovensereddingsbrigade.com/uploads/1/3/0/5/130589237/tujuwu.pdf
    • http://nicsantrading.com/uploads/1/3/0/5/130543995/fe9134a044a.pdf
    • http://milablooms.com/uploads/1/3/0/7/130776763/81872f56be22e25.pdf
    • http://buzzfanzine.com/uploads/1/3/0/5/130540246/zasafagugumapi_wabowodul.pdf
    • http://machemollo.com/uploads/1/3/0/5/130543092/vonajapefedowuj.pdf
    • http://www.oneill-accountancy.co.uk/uploads/1/3/0/2/130289320/siditokota-zojemuroziveta.pdf
    • http://adelaidehulahoopers.com.au/uploads/1/3/0/5/130590399/69b44572.pdf
    • http://coffeebeansandbrew.com/uploads/1/3/0/3/130313005/rurikiduka_xojixezolemep_watosezobu.pdf
    • http://newlineofficefurniture.net/uploads/1/3/0/6/130640164/9557044.pdf
    • http://jmcounselingservices.com/uploads/1/3/0/4/130476743/3d150f214.pdf
    • http://archercdc.com/uploads/1/3/0/5/130542902/1494205.pdf
    • http://alextindall.net/uploads/1/3/0/4/130476866/4437345.pdf
    • http://qtsatelier.com/uploads/1/3/0/3/130313854/6668293.pdf
    • http://maritimeconferencecenter.devsite-1.com/uploads/1/3/0/6/130604441/130604441.html#tratamiento+de+acidosis+metabolica+en+neonatos
    • http://eindhovensereddingsbrigade.com/u

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ab3.bin
20f640300ce762b834faf80b299673e23ad7e96631892eabeaaf2b01f5cc2b07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3AB3 9016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.