Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf4b44f54ec1f6f1…

MALICIOUS

PDF

52.8 KB Authoring application: Karbon
MD5: 40c452023b02dd3bb68928c94c488b27 SHA-1: bb23068cc97ac92750b37506d249c46d99173464 SHA-256: cf4b44f54ec1f6f1b20a577249551115cb4e555e0bb62c5290cd7d284c080823
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits characteristics of a phishing lure, as indicated by the 'PDF_SEO_LINK_FARM' heuristic which detected a mass of external PDF links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment. The embedded URLs, such as http://mortargroutepoxy.com/uploads/1/3/0/6/130620736/zekukoluta_kisukofedajuv.pdf, are likely part of a campaign to redirect users to malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mortargroutepoxy.com/uploads/1/3/0/6/130620736/zekukoluta_kisukofedajuv.pdf
    • http://konect2us.com/uploads/1/3/0/4/130476266/worede_xexuvatononid_lekevuxe.pdf
    • http://nothingtotriflewith.com/uploads/1/3/0/6/130620163/1660232.pdf
    • http://arthurdogsontodd.com/uploads/1/3/0/5/130588624/dexuwilavipep_rotinarukon_gadawevovabireb.pdf
    • http://jawi.stroymarketmetal.ru/uploads/2020/01/28/modori.pdf
    • http://stdesignmatters.com/uploads/1/3/0/7/130738512/6db298eabf.pdf
    • http://pioneerrisknetwork.net/uploads/1/3/0/5/130541073/6784821.pdf
    • https://jetekomutituxi.weebly.com/uploads/1/3/0/5/130540046/f4be49040f98fe.pdf
    • http://collegeeducationonline.net/uploads/1/3/0/6/130639504/ganakumogu.pdf
    • http://message6666.com/uploads/1/3/0/7/130739127/130739127.html#skyrim+racemenu+error

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000128b.bin
ac99ed671460bdd32137865d6b92593892b7b86616b44a2d0949b2ea9bdcee45		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128B 8692 bytes
font_01_sfnt_off00008905.bin
762dcdd9ba4f49da9304d24ca69c2c3f9505d1a2d992a25200f0994f7f4993d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8905 16072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.