Malicious PDF — malware analysis report

Static analysis result for SHA-256 a00e600ea7b1a057…

MALICIOUS

PDF

48.9 KB Authoring application: Karbon
MD5: c7237cc5c79c084b78d3dcee89a53fbe SHA-1: f9bde1f3ba09ea31367a931403207a7dc93f64f6 SHA-256: a00e600ea7b1a0572bbb727a527e8ffa90d4155469ede08a888b67f34aee991c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The embedded URLs likely serve as a lure to redirect users to potentially harmful content hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://backtopulse.com/uploads/1/3/0/6/130620665/votulujawotulo.pdf
    • http://women-network.org/uploads/1/3/0/5/130542894/2165780.pdf
    • http://boshuster.com/uploads/1/3/0/6/130639513/wufuxewis.pdf
    • http://us.momotombochocolatefactory.com/uploads/1/3/0/5/130545537/towejol.pdf
    • http://gupijelan.cosmokot.ru/uploads/2020/01/28/d0fab3.pdf
    • http://sunsetridgeatlanesend.ca/uploads/1/3/0/2/130270942/61905f.pdf
    • http://sonsetministries.com/uploads/1/3/0/6/130620237/xilanijaz-peziniwexizaj-muwumebolefeb.pdf
    • http://swellbathrooms.com/uploads/1/3/0/4/130483047/5605921.pdf
    • http://nftesouthflteachers.com/uploads/1/3/0/7/130740566/fcef63f4.pdf
    • http://yodel.services/uploads/1/3/0/6/130620916/1657633.pdf
    • http://t4gg.com/uploads/1/3/0/4/130435588/xesinejij-waloxadasup-fijavemilesej.pdf
    • http://rosiemillicentkeating.com/uploads/1/3/0/6/130605072/ratilolegap-diwulisiposugu.pdf
    • http://newperspectivemedical.com/uploads/1/3/0/7/130775998/130775998.html#google+calendar+app+for+windows+8

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014e5.bin
0def92c825e741758be558f62107354c19043225fc2408882ed0aca3844a4469		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14E5 8244 bytes
font_01_sfnt_off00007940.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7940 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.