Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b18f7891b644a50…

MALICIOUS

PDF

46.9 KB Authoring application: Karbon
MD5: 1fcc4b251127b6b340b052935f9579ec SHA-1: 253225865f5409bb1bd7a2cdd24855282d546aaf SHA-256: 9b18f7891b644a5086de3239959acf3c4673599cb0d3feb113d4d3686b962ef3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, with the primary one pointing to 'acehomecareservicewherewe.com'. This heuristic, combined with ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', strongly suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'Spoken english guru daily use sentences book', likely a lure. No scripts were extracted, limiting the analysis of direct payload execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://acehomecareservicewherewe.com/uploads/1/3/0/2/130291463/jimezagudagiriw.pdf
    • https://gebiraferoti.weebly.com/uploads/1/3/0/5/130552053/nobito.pdf
    • http://momentswithmadds.org/uploads/1/3/0/4/130483767/danubagovuli-dezisabar.pdf
    • http://saharaexchange.com/uploads/1/3/0/6/130604363/puzerab.pdf
    • http://ofoptical.com/uploads/1/3/0/4/130475918/fazabimopin_bisonavevojosaz_vowan_berufevixo.pdf
    • http://brightbuzz.biz/uploads/1/3/0/2/130289327/nutogep.pdf
    • http://mermaidicamusic.com/uploads/1/3/0/7/130775630/tokezurenoraru.pdf
    • http://message6666.com/uploads/1/3/0/5/130588410/84d6faebb.pdf
    • http://obpassociation.com/uploads/1/3/0/5/130551058/2763219.pdf
    • http://stacyinexile.com/uploads/1/3/0/7/130775049/2830187.pdf
    • http://michaudwellness.com/uploads/1/3/0/7/130775935/130775935.html#spoken+english+guru+daily+use+sentences+book

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001246.bin
65914d3d804003f6d9b01bb0e0730a4b6885b4ad3530376c000681219069d982		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1246 7908 bytes
font_01_sfnt_off0000492e.bin
32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x492E 16164 bytes
font_02_sfnt_off00005df3.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DF3 1388 bytes
font_03_sfnt_off000066a9.bin
c17cdfc09978a85e1592131dddab52f9e9fbf02aab0e0a2296c2a4c141c246b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66A9 11336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.