Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1e2d6045b744aa8…

MALICIOUS

PDF

43.7 KB Authoring application: Karbon
MD5: 3a23ba0f8965d9a3cbff3ee56609a8ee SHA-1: 25031832f0c620d60e1ad83041f5a165d770b2f3 SHA-256: b1e2d6045b744aa858e2ec398ddc35f813e15c15b44433fa40a5e4cad6f69268
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of a mass external PDF link farm, with the first URL being http://www.kj2camp.com/uploads/1/3/0/2/130272342/5683474.pdf. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.kj2camp.com/uploads/1/3/0/2/130272342/5683474.pdf
    • http://catskillsupplyco.com/uploads/1/3/0/2/130272937/tesaj.pdf
    • http://konrn.com/uploads/1/3/0/5/130551927/6cc1d.pdf
    • http://www.heartlanddeermanagement.com/uploads/1/3/0/6/130604907/7085009.pdf
    • http://shrinkingvioletjewellery.com/uploads/1/3/0/5/130544447/8ddd9851d6b7.pdf
    • http://autodiscover.parkavenueparties.com/uploads/1/3/0/6/130621206/40284.pdf
    • http://theroadtosobriety.com/uploads/1/3/0/4/130488920/kijujupekuda.pdf
    • http://qmenthailand.com/uploads/1/3/0/7/130739316/ruwugebipi.pdf
    • http://www.eosfinancialplanning.com/uploads/1/3/0/7/130775927/gakogiwolotelilekino.pdf
    • http://webdisk.finnandbuffy.com/uploads/1/3/0/9/130969989/6445460.pdf
    • http://collabassist.com/uploads/1/3/0/7/130775560/7f9192.pdf
    • http://shadyhillskennel.com/uploads/1/3/0/7/130739879/9993368.pdf
    • http://jlcigars.com/uploads/1/3/0/5/130588389/3780e55857bbd94.pdf
    • http://thembmethod.com/uploads/1/3/0/5/130588681/nuvuterurawu.pdf
    • http://nissanpatrolparts.com/uploads/1/3/0/6/130639256/ec1513739d.pdf
    • http://neighborhoodinvolve.org/uploads/1/3/0/6/130622042/2083159.pdf
    • http://drivegauge.com/uploads/1/3/0/8/130874317/lejivutun.pdf
    • http://mvctk.com/uploads/1/3/0/4/130483546/tixujab.pdf
    • http://managesky.com/uploads/1/3/0/8/130874340/7188658.pdf
    • http://www.attractiveopenings.designpreviewer.com/uploads/1/3/0/5/130540266/d636d5fad85fd4d.pdf
    • http://porktexas.com/uploads/1/3/0/5/130589101/abb403138ef7af.pdf
    • http://helpking.org/uploads/1/3/0/4/130483587/6533883.pdf
    • http://www.supermenlawncare.com/uploads/1/3/0/7/130775806/9368970.pdf
    • http://mbyj.net/uploads/1/3/0/4/130491008/f9276d942a.pdf
    • http://horizonsaerial.com/uploads/1/3/0/7/130776504/litogukugoxegolo.pdf
    • http://psktravel.voyagerwebsites.com/uploads/1/3/0/2/130287299/130287299.html#fmea+fmpa+conference
    • http://www.eosfinancialplanning.com/uploads/1/3/0/7/130775927/gakogiwolotelilekino

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045e3.bin
8be79a765e494f789b03181085aecbd6aa628ca8ab23649981cdb8880b208e3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45E3 8592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.