Malicious PDF — malware analysis report

Static analysis result for SHA-256 c51312f01793bc86…

MALICIOUS

PDF

29.6 KB Authoring application: Karbon
MD5: 8461acc7509bb2e3308bc70bd9b68e97 SHA-1: 1e78d9081c5c536a5c8ea61389bfb08d6a43d292 SHA-256: c51312f01793bc864fc528258000f80cd864fa17ebad6db0e2674123d9729f41
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection also flags it as phishing-related. No scripts were extracted from this sample, but the extensive URL list is the primary indicator of malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sax.audiostart08.icu/uploads/2020/01/29/vanuwekonab.pdf
    • http://swag.org.uk/uploads/1/3/0/5/130540197/4965866.pdf
    • http://pittybullystaffyaddicts.com/uploads/1/3/0/6/130604411/derubilojimafo.pdf
    • http://monthlyphysicalchallenge.com/uploads/1/3/0/5/130541028/vedogagiporaduvuro.pdf
    • http://westranchswim.com/uploads/1/3/0/5/130551434/4192866.pdf
    • http://favu.goriteam.xyz/uploads/2020/01/27/remamam.pdf
    • http://mpholistichealth.com/uploads/1/3/0/4/130476150/bufewa.pdf
    • http://pidira.vpalatke.pro/uploads/2020/01/27/d1ada355c1271.pdf
    • http://xlimitentertainment.com/uploads/1/3/0/2/130289735/281123.pdf
    • https://lamatosuwupovi.weebly.com/uploads/1/3/0/2/130289380/pemaniritefawuv_segeke_jobokibip_segadotetid.pdf
    • http://kcareerandlifecoaching.com/uploads/1/3/0/5/130590477/kasud-boselalawal-jafirowavejin-jumux.pdf
    • https://levikujakezodu.weebly.com/uploads/1/3/0/4/130476821/poraxusodebibab-kipowaforumusi-walutijitiroger-kepijezoriko.pdf
    • http://tikabineb.vipiski-online.icu/uploads/2020/01/27/towodavosimo-difureme-vuxaj-refaxajojez.pdf
    • http://catiejoy.com/uploads/1/3/0/5/130590278/25bad3.pdf
    • http://hrvatskihublin.weebly.com/uploads/1/3/0/2/130289283/643d5b142355.pdf
    • http://malo.koshkanusya.com/uploads/2020/01/28/c5e045828.pdf
    • http://gex.raz-ezzhaya.ru/uploads/2020/01/27/kavewapozawenavaj.pdf
    • http://mikeandthebigscary.com/uploads/1/3/0/6/130604626/pigilitutilab-fopufu-rebakuro-gegofoje.pdf
    • http://abundantyoga.com.au/uploads/1/3/0/6/130620240/130620240.html#dynamic+viewpager+adapter+android

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014ee.bin
62e99561bafb7d6ad9891e60c4e6e37c11c452cba0020db84363c8cd855d960e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14EE 5872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.