Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7a1a6d8ee5ddc62…

MALICIOUS

PDF

38.8 KB Authoring application: Karbon
MD5: 83d97fb4c206334ee6fa533094c6f630 SHA-1: e20337a30f3318285fe3599be65630555d0d67ac SHA-256: d7a1a6d8ee5ddc6260cb191a826a100c864b3e18ef9bc6ef2dbf1feebfc607e8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, indicating a link farm designed to redirect users. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection motive. The document body, though partially corrupted, contains text related to report writing and mentions an external PDF, aligning with the link farm heuristic.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://poshexecutivetravel.com/uploads/1/3/0/5/130588328/40dd9bbd89ea8c0.pdf
    • http://meowsitting.co.uk/uploads/1/3/0/6/130640194/vurut.pdf
    • http://mesys-industrial.net/uploads/1/3/0/6/130620460/komewe.pdf
    • http://shadowbendtest1.com/uploads/1/3/0/7/130775682/7219707.pdf
    • http://movingtosantodomingo.com/uploads/1/3/0/6/130621868/7fc751f3.pdf
    • http://mounthebronstem.com/uploads/1/3/0/7/130776743/697ca71319b.pdf
    • http://joblanta.com/uploads/1/3/0/5/130551782/lasodo.pdf
    • http://blackhatbakery.com/uploads/1/3/0/7/130775615/jukekegopib.pdf
    • http://mythosbaklava.ca/uploads/1/3/0/6/130639355/biwelidini.pdf
    • http://kidcitizen.com/uploads/1/3/0/3/130379287/movame_ruzapukos_xomib_venopez.pdf
    • http://whiteshipstudio.com/uploads/1/3/0/5/130590763/d8b5f39f41.pdf
    • http://ticaea.com/uploads/1/3/0/6/130621413/jigutaxe.pdf
    • http://librosdeluz.net/uploads/1/3/0/4/130475990/65b7a.pdf
    • http://northeconstruction.com/uploads/1/3/0/5/130588905/5657669.pdf
    • http://bharpermd.com/uploads/1/3/0/8/130874655/98655b.pdf
    • http://myhappilyeverafters.com/uploads/1/3/0/3/130312965/lowikot-panop-dukiwades.pdf
    • http://janemartinmediation.com/uploads/1/3/0/4/130488243/lavawuzedeti_fasufo.pdf
    • http://thebutternutbeat.com/uploads/1/3/0/6/130605426/mufifukuwomakotegon.pdf
    • http://index92.pleasingfood.com/uploads/1/3/0/6/130605312/130605312.html#simple+report+writing+format+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ac6.bin
488b3f1c40a6dd392b408869dc06c056a68da7230b0059413bb9f7ad2bb5473e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3AC6 7776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.