Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7d7a559067b2223…

MALICIOUS

PDF

39.5 KB Authoring application: Karbon First seen: 2020-09-24
MD5: 2e1cfa46fa5a3d0300771b80414712c7 SHA-1: ffdef92d58d524aa3acc90a763a526eba56aa20e SHA-256: e7d7a559067b2223a77530ec1071fcd622ffca4c329db2eeb5fd2906c680488c
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a mass of external links, many of which point to other PDFs hosted on SEO-optimized domains. This pattern is indicative of a link farm designed to redirect users to malicious content or generate ad revenue. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://porochista.org/uploads/1/3/0/6/130620456/filivu-mifalizosugoje-nufamu-pirivova.pdf In PDF document text
    • http://nordicin.net/uploads/1/3/0/3/130379590/niragimajoviregopuw.pdfIn PDF document text
    • http://cashoffer2day.com/uploads/1/3/0/8/130874381/3192545.pdfIn PDF document text
    • http://akronglobal.net/uploads/1/3/0/6/130604344/1111037.pdfIn PDF document text
    • http://jinduzhenrenyule.f18.ebkf.org/uploads/1/3/0/3/130323896/taketoxepukajurev.pdfIn PDF document text
    • http://waffledaze.com/uploads/1/3/0/5/130590777/5522126.pdfIn PDF document text
    • http://circumchange.ca/uploads/1/3/0/5/130551387/b5149e.pdfIn PDF document text
    • http://chiciang.com/uploads/1/3/0/6/130603892/madigon_noxumoxem_bazawekiwafix.pdfIn PDF document text
    • http://absystemsllcscam.com/uploads/1/3/0/4/130489841/bibediri-gigebatu.pdfIn PDF document text
    • http://thesockingdead.com/uploads/1/3/0/3/130379959/papojotemew_kewivegobonij_wemoluw.pdfIn PDF document text
    • http://www.therockoutz.com/uploads/1/3/0/6/130603978/jidudafa_belirusa_nosodexolu_sesomobemoz.pdfIn PDF document text
    • http://neurologiccare.com/uploads/1/3/0/8/130813618/2307644.pdfIn PDF document text
    • http://journey2wholeness.net/uploads/1/3/0/3/130323932/pekim.pdfIn PDF document text
    • http://newmarketcrossfit.com/uploads/1/3/0/5/130589209/konolez.pdfIn PDF document text
    • http://www.ajoboerenhulp.eu/uploads/1/3/0/8/130813765/7e30063ff.pdfIn PDF document text
    • http://deadbeatbuddy.com/uploads/1/3/0/5/130540458/vixomasop_xudejulobe_nibemelofimus.pdfIn PDF document text
    • http://preludetoaction.com/uploads/1/3/0/4/130492771/vejovotigazimaxojok.pdfIn PDF document text
    • http://hotels-hanoi.net/uploads/1/3/0/4/130490245/lutesokunaj_zolofik.pdfIn PDF document text
    • http://runningwildinflatables.net/uploads/1/3/0/8/130813533/dilaluvatan.pdfIn PDF document text
    • http://noordinarygames.com/uploads/1/3/0/7/130775858/e6bf794.pdfIn PDF document text
    • http://mta-sts.cafecarpenter.com.au/uploads/1/3/0/6/130604589/30b4182c5a83c.pdfIn PDF document text
    • http://doublehranch.ca/uploads/1/3/0/6/130621707/wibosop.pdfIn PDF document text
    • http://hidefdjs.com/uploads/1/3/0/3/130323884/xujizumitoxe.pdfIn PDF document text
    • http://www.equestrianeliteatapplejackfarm.com/uploads/1/3/0/5/130539287/130539287.html#ielts+academic+writing+task+2+model+answersIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003906.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3906 7444 bytes
SHA-256: 3a4bcb6e30630655583717df8ab8afbbbd019baae84999742b05f87a3258c8df

Open this report in the interactive analyzer, or submit your own file for analysis.