Malicious PDF — malware analysis report

Static analysis result for SHA-256 babc21c623bedd86…

MALICIOUS

PDF

48.7 KB Authoring application: Karbon
MD5: e8cc436a717f2f31f129ca912cee60dd SHA-1: cd8c0632187d1864dca64ef3c7044f644289721c SHA-256: babc21c623bedd8616c90b2c97e43f33c9fc3bc3f098c54defbfc21ee6e8909a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF files across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or execution methods.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nostalgist.net/uploads/1/3/0/5/130543980/2615050.pdf
    • http://nwcg.yourgin.com/uploads/1/3/0/6/130622023/kukuw.pdf
    • http://turnred.com/uploads/1/3/0/4/130436165/tibisowobunulu-surifejeniribu-zubesaw.pdf
    • http://retreatsinjapan.com/uploads/1/3/0/5/130540823/6554682.pdf
    • http://mivomaskin.no/uploads/1/3/0/6/130621075/7228586.pdf
    • http://daddysduties.com/uploads/1/3/0/7/130775950/1400793.pdf
    • http://sennad.store/uploads/1/3/0/6/130604090/8819833.pdf
    • http://interstellarbrands.com/uploads/1/3/0/7/130775109/c18baa315956ad5.pdf
    • http://tdf20years.com/uploads/1/3/0/5/130590719/fakaveresupejatobilu.pdf
    • http://mpowerempire.com/uploads/1/3/0/6/130604657/4119713.pdf
    • http://growtem.com/uploads/1/3/0/7/130775622/davorewaj-ziriladun-vewuji.pdf
    • http://mjvsms.ca/uploads/1/3/0/4/130490117/jopebifitul-tawiwo-tupanonaduda.pdf
    • http://fpuunderground.com/uploads/1/3/0/7/130776474/2563344.pdf
    • http://cristofori.online/uploads/1/3/0/4/130477287/17bbe2fd8.pdf
    • http://dramaclubplays.com/uploads/1/3/0/7/130738565/f807729f7a89158.pdf
    • http://wetlandecologybook.com/uploads/1/3/0/5/130540699/jerevebimup.pdf
    • http://bluecrabkeyflorida.com/uploads/1/3/0/2/130289703/2539125.pdf
    • http://kokavi.com/uploads/1/3/0/7/130776208/a678e37a824f1.pdf
    • http://vliegendestoel.nl/uploads/1/3/0/7/130738803/54ce1df74.pdf
    • http://www.designfirmseminars.com/uploads/1/3/0/3/130379205/delafufesanefodukeju.pdf
    • http://bevinbranlandingham.com/uploads/1/3/0/6/130621148/tuvositibosubu.pdf
    • http://musiowskyed.com/uploads/1/3/0/7/130738854/0727301b8859b.pdf
    • http://reinasporunacausa.com/uploads/1/3/0/7/130739132/texod-vabigesikat.pdf
    • http://digitalsystemresearch.com/uploads/1/3/0/2/130272484/gunusino.pdf
    • http://wcd-3ni9vm8.mgh-r.ch/uploads/1/3/0/3/130313243/130313243.html#romeo+and+juliet+act+ii+scene+ii+summary

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f7f.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea
pdf-font-stream PDF embedded font (sfnt) at offset 0x4F7F 2652 bytes
font_01_sfnt_off00005b7a.bin
55cad3a383f5313abb176a3fee78a69083c7c1253c7ee0db82450ba8e5555c92
pdf-font-stream PDF embedded font (sfnt) at offset 0x5B7A 8120 bytes