Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd4e08aacc0903dc…

MALICIOUS

PDF

30.5 KB Authoring application: Karbon
MD5: 59190ae8dd44838eb79532866b6f55f7 SHA-1: 5c7ee410dda7c09549bd28d4ada2a84f2b6415c4 SHA-256: bd4e08aacc0903dccbe229b2b2e1d1b433b4e336adae2835d2ec2a65dd3e7343
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded external links, a common technique for SEO poisoning or directing users to phishing pages. The document body contains text related to song lyrics and metadata, which appears to be a lure to disguise the malicious intent of the embedded links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.trendsterrabella.com/uploads/1/3/0/6/130604382/nuzebaxexujejisosez.pdf
    • http://endoflineclothing.com/uploads/1/3/0/6/130621853/mumor.pdf
    • http://dalestravel.info/uploads/1/3/0/2/130272344/8647182.pdf
    • http://roguepilots.com/uploads/1/3/0/5/130545382/00fd6e14.pdf
    • http://atmos-home.com/uploads/1/3/0/8/130874282/goruzuwisos-paselarupop-pogamirizilitol-zejebum.pdf
    • http://mycompanybenchmarks.com/uploads/1/3/0/3/130324065/9691656.pdf
    • http://eyelashsalonlien.com/uploads/1/3/0/8/130813648/def6633eb92c5.pdf
    • http://goodoverheard.com/uploads/1/3/0/6/130605217/9406830.pdf
    • http://notyourfathersadvisor.com/uploads/1/3/0/7/130739340/pizulepepexewik_geruwusepib.pdf
    • http://plutusmerchants.com/uploads/1/3/0/6/130604589/wejuv.pdf
    • http://saddlemachine.com/uploads/1/3/0/6/130621051/murikow.pdf
    • http://realii.org/uploads/1/3/0/3/130323517/4ca3cc340c.pdf
    • http://jackmillerslanding.net/uploads/1/3/0/7/130776898/bibidukorutepep.pdf
    • http://cordofcallowsdocumentaryfilm.com/uploads/1/3/0/7/130740266/fufog-miditororodizu-juvogu.pdf
    • http://adsl-63-204-18-22.benefitplans.org/uploads/1/3/0/9/130969628/130969628.html#thousand+years+guitar+chords+easy+version

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001bb1.bin
ef2d2f6954758ae70759be0584690d07c898e87ccb99297da5322d154b43e54f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BB1 7016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.