Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba8dced66d6451f5…

MALICIOUS

PDF

39.3 KB Authoring application: Karbon
MD5: 4b7021f45db2af5e0aa947de4e25dc6e SHA-1: 5da894c31243245e67c7dc26f0f0e9e027462416 SHA-256: ba8dced66d6451f58a707030c5b3c1336bb8ea2336fc5114f9c6e8a839e5293f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm or redirection scheme, commonly used in phishing or malware distribution campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-generating malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://univentapp.com/uploads/1/3/0/6/130605475/1626181.pdf
    • http://cascadecyclists.com/uploads/1/3/0/7/130775588/452337.pdf
    • http://scalefreenetworks.com/uploads/1/3/0/6/130621127/vivale.pdf
    • http://pixelmatic.org/uploads/1/3/0/6/130621515/tavevi_gomaniwoxuvuv.pdf
    • http://www.proteus-mrighifu.net/uploads/1/3/0/6/130605383/dopederopazu.pdf
    • http://mymassagedude.com/uploads/1/3/0/6/130620532/nevomevavixoxuxono.pdf
    • http://www.cherrygamenews.com/uploads/1/3/0/2/130288386/siwikudo.pdf
    • http://tech-trend-style.com/uploads/1/3/0/4/130477192/3521993.pdf
    • http://mysoundcollective.com/uploads/1/3/0/6/130620819/3013d.pdf
    • http://cabinetmakersipswich.com.au/uploads/1/3/0/4/130476981/tefagivo-viwevaj-rebadujetugode.pdf
    • http://mountedcharger.com/uploads/1/3/0/6/130603721/e817da23f.pdf
    • http://www.medicolegalrehab.co.uk/uploads/1/3/0/5/130543546/77d3173740c217.pdf
    • http://planettammy.com/uploads/1/3/0/4/130476447/2b6ef.pdf
    • http://potentevisuals.com/uploads/1/3/0/7/130775310/jivopeguluxikikakap.pdf
    • http://terratechwiki.com/uploads/1/3/0/5/130548192/gituguwexisu.pdf
    • http://topecigarettereviews.com/uploads/1/3/0/7/130775840/29bbeffad64403b.pdf
    • http://gradecaddy.com/uploads/1/3/0/3/130324192/nixozizolo-godajolek-lapoxogoroko-pipugenod.pdf
    • http://www.egenpolisci.com/uploads/1/3/0/9/130969871/753e2.pdf
    • http://hostmaster.indoorcyclinginstitute.com/uploads/1/3/0/4/130483552/22736c472b4982.pdf
    • http://emilytiberio.com/uploads/1/3/0/3/130323437/9228377.pdf
    • http://tenzo.me/uploads/1/3/0/6/130604467/708772.pdf
    • http://tifon.org/uploads/1/3/0/7/130775782/3766911.pdf
    • http://4pwcrv.bdgct.com/uploads/1/3/0/5/130539034/130539034.html#phosphate+buffer+solution+ph+range

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000036de.bin
88d7714a9db2a081b55f69203d9d986cadbc457218bf7ca7917fa9c6c1fccff4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36DE 8516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.