Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5491a626433f7f9…

MALICIOUS

PDF

48.7 KB Authoring application: Karbon
MD5: 22b3305ba5295869c9c417d4d4c5b47f SHA-1: edc7cca2fb9eff708b1f259d51d356d953b057a7 SHA-256: b5491a626433f7f935619135f89afc3c2ba4fd0ff9acd994576a8823607ed6c9
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of a visual download button lure further indicate a phishing or malware distribution attempt. The embedded URLs are likely part of this distribution network.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seeme4sex.net/uploads/1/3/0/4/130476684/nasejolofewupitok.pdf
    • http://metroattorneyreviews.com/uploads/1/3/0/7/130738821/lazivufip.pdf
    • http://my-wilcox.com/uploads/1/3/0/4/130490488/de3c05ce.pdf
    • http://dixielandv.com/uploads/1/3/0/6/130639459/b0f696d171f.pdf
    • http://omggrafx.com/uploads/1/3/0/4/130483373/waginiwilixeveburemi.pdf
    • http://eileenmenzel.com/uploads/1/3/0/5/130545097/zoporaluz_pebajik_fivadog.pdf
    • http://austinaction.com/uploads/1/3/0/6/130605368/tezedexewemomed.pdf
    • http://holochainers.com/uploads/1/3/0/7/130775808/guwaxezutori-xatufedo-butafevi.pdf
    • http://fountainalleybodycare.com/uploads/1/3/0/7/130739967/bewujosebojarikulo.pdf
    • http://ijjackel.com/uploads/1/3/0/6/130639117/18ab31f64367.pdf
    • http://katedunsmoresmith.com/uploads/1/3/0/8/130814529/fukomumirijatepa.pdf
    • http://mercyministrystl.org/uploads/1/3/0/2/130271184/jekilolurepepubivab.pdf
    • http://soytacos.com/uploads/1/3/0/2/130289557/bedevatuk.pdf
    • http://stockbroker-fraud-lawyer.com/uploads/1/3/0/6/130621134/biwube.pdf
    • http://nicolasvaradi.com/uploads/1/3/0/4/130491079/d082d5996474b6b.pdf
    • http://claudiawells.net/uploads/1/3/0/6/130604958/7522099.pdf
    • http://clarinetrepairs.org/uploads/1/3/0/7/130739164/mugagivim.pdf
    • http://teachmecoding.net/uploads/1/3/0/4/130483273/duloramesixuj-xafoxixelekifi-womufoto-favosefiratuno.pdf
    • http://miss-diva.com/uploads/1/3/0/6/130603979/5deb32ff0fc.pdf
    • http://carriageclassic.org/uploads/1/3/0/5/130539981/8b21b14.pdf
    • http://danceofthemagi.com/uploads/1/3/0/5/130543092/56e0cc58a.pdf
    • http://74-123-79-238.mgwnet.com/uploads/1/3/0/7/130739301/130739301.html#a+guide+to+descriptive+writing+practice+book.pdf+free+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003959.bin
3a7edcf396ef3872fbc6650f1b3a76bfe2092c910d8ae7395f77e7050ecf9a21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3959 12264 bytes
font_01_sfnt_off00005cc2.bin
e0802ff44c1e1eb23eaa481b8c847447b3bfcdf8a9612ab225fe9fd61b8977f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CC2 8608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.