Malicious PDF — malware analysis report

Static analysis result for SHA-256 dcc17bbccccdc32e…

MALICIOUS

PDF

44.4 KB Authoring application: Karbon
MD5: 9f050c26101fc20d7c0fd541a42c679c SHA-1: 395fd9d04024b7ec68cc3f980bd67579d58753c0 SHA-256: dcc17bbccccdc32e1c367b82b809c19ca150f1c0979e3f99da114882cd3a3bfa
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, indicating a link farm or redirection scheme. The heuristic PDF_SEO_LINK_FARM and the ML classifier strongly suggest malicious intent, likely for SEO spam or phishing. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports this. No scripts were extracted, but the primary attack pattern is the distribution of malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://haloesmixers.com/uploads/1/3/0/2/130287835/b24ff46e865.pdf
    • http://bsr-project.com/uploads/1/3/0/5/130541846/foratobirakuvixudeta.pdf
    • http://bewellmindset.net/uploads/1/3/0/3/130379336/b2a2902886.pdf
    • http://animalandiagta.com/uploads/1/3/0/8/130814133/f15a6f5598a.pdf
    • http://labeach.com/uploads/1/3/0/7/130740164/memedivep_tebuwijibuveva_monovogosozajo_livapo.pdf
    • http://beatwood.eu/uploads/1/3/0/4/130490151/b8ad8115.pdf
    • http://repairplumberfortworth.net/uploads/1/3/0/6/130604049/d0ebd01f1c0f1.pdf
    • http://chichomeinterior.com/uploads/1/3/0/6/130603753/9fa520b17.pdf
    • http://crossconnextion.com/uploads/1/3/0/3/130313156/6040773.pdf
    • http://davideacconciature.com/uploads/1/3/0/3/130324419/rigugiparukowo_weketidimadozod.pdf
    • http://mtglend.net/uploads/1/3/0/5/130588278/2a31530bc583.pdf
    • http://alaskacenterforfasd.com/uploads/1/3/0/4/130476243/kagifiz_gitijufikus.pdf
    • http://rapidpermitreviewhawaii.com/uploads/1/3/0/6/130639901/130639901.html#ielts+advantage+reading+skills+pdf+vk
    • http://bewellmindset.net/uploads/1

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fc7.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FC7 16204 bytes
font_01_sfnt_off00004a50.bin
5ab083999b4651ae57fdfef9d0c6b181bfc8c18f5c6695f22a8de09316bcc0c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A50 13796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.