Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4d4f7fc98d2cdc6…

MALICIOUS

PDF

56.2 KB Authoring application: Karbon
MD5: 6bb9802be88facd014cf87968d57f681 SHA-1: 91f1d07eac59a584ea3a66a06ad847b41f69fe39 SHA-256: c4d4f7fc98d2cdc6795fe9a2628464e9628da03cfb61ea6ccc1f67c3947fa2cc
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The critical heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external PDF links, with the first identified URL being http://deblokletter.be/uploads/1/3/0/4/130476491/gomoxal.pdf. This suggests the document is designed to redirect users to a network of malicious sites, likely for credential harvesting or further malware delivery.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://deblokletter.be/uploads/1/3/0/4/130476491/gomoxal.pdf
    • http://cabinetdanconsulting.com/uploads/1/3/0/4/130478602/xirilimaminisok-wusob.pdf
    • http://nintaipartners.com/uploads/1/3/0/6/130603809/159f2f9649c.pdf
    • http://jewuw.ourverify.com/uploads/2020/01/28/1903037.pdf
    • http://petalesdefleurs.com/uploads/1/3/0/5/130543084/5b8e6fa8b226b76.pdf
    • http://missioncovenantyouth.org/uploads/1/3/0/2/130274371/fidobidosulubefatori.pdf
    • http://northernrailleaders.com/uploads/1/3/0/4/130490643/130490643.html#bangla+natok+boro+chele+song

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000128c.bin
9768b81ebefc117e38b3cba70cc63a8730d3a148718c7c390e3da2f5dce09e5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128C 7980 bytes
font_01_sfnt_off00006f34.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F34 1388 bytes
font_02_sfnt_off00007932.bin
b1301cfd4d348c58e0dc4121aebc80a4513edffd54a068e97f22c87fec7fea01		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7932 18548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.