Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4026cc9176d79d4…

MALICIOUS

PDF

41.5 KB Authoring application: Karbon
MD5: 26577436692e91180746a3b38c30ea25 SHA-1: b330249b9c936de58db922bcc1abc02b07e9b719 SHA-256: d4026cc9176d79d44f5ef4ef68175fba7bfdfc1f7683d5121989c19b0bb5786e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical alert for a link farm and a high ML score, indicating malicious intent. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this. The document body contains numerous embedded URLs pointing to other PDF files, suggesting a phishing or redirection scheme designed to lead users to malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://u-ehs.com/uploads/1/3/0/2/130291939/8880509.pdf
    • http://pattenacademy.net/uploads/1/3/0/5/130544091/kimaruribebivesuma.pdf
    • http://allprocustompoolandsupplies.com/uploads/1/3/0/4/130488701/4f89c25e04c481.pdf
    • http://palliativecareforuganda.com/uploads/1/3/0/3/130313359/3989086.pdf
    • http://nicksarno.com/uploads/1/3/0/4/130477414/2d8c7a.pdf
    • http://mycharlottedoulas.com/uploads/1/3/0/6/130621238/9938993.pdf
    • http://collabra-nation.com/uploads/1/3/0/7/130739706/6569507.pdf
    • http://moksamassage.com/uploads/1/3/0/6/130620885/3170190.pdf
    • http://sarahleesy.com/uploads/1/3/0/6/130604693/datejepi-mojiro.pdf
    • http://theorderoftheoak.org/uploads/1/3/0/2/130270798/83e0a170cbc491.pdf
    • http://nancyrancher.life/uploads/1/3/0/5/130545666/995771.pdf
    • http://breakgroundkidscode.com/uploads/1/3/0/7/130775918/muwuvonigimimima.pdf
    • http://asociacionperiodistaspr.org/uploads/1/3/0/7/130776883/130776883.html#positive+accounting+theory+example

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012de.bin
77f1b18c67dd6c9be4ce9116d0ffbd2e15464bdd7b1711409fed9b7dbdf9cfa4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DE 8116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.