Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7d7a559067b2223…

MALICIOUS

PDF

39.5 KB Authoring application: Karbon
MD5: 2e1cfa46fa5a3d0300771b80414712c7 SHA-1: ffdef92d58d524aa3acc90a763a526eba56aa20e SHA-256: e7d7a559067b2223a77530ec1071fcd622ffca4c329db2eeb5fd2906c680488c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. This suggests a phishing or SEO manipulation tactic, aiming to drive traffic to potentially malicious or spam content. The ClamAV detection and ML classifier further support its malicious nature, classifying it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://porochista.org/uploads/1/3/0/6/130620456/filivu-mifalizosugoje-nufamu-pirivova.pdf
    • http://nordicin.net/uploads/1/3/0/3/130379590/niragimajoviregopuw.pdf
    • http://cashoffer2day.com/uploads/1/3/0/8/130874381/3192545.pdf
    • http://akronglobal.net/uploads/1/3/0/6/130604344/1111037.pdf
    • http://jinduzhenrenyule.f18.ebkf.org/uploads/1/3/0/3/130323896/taketoxepukajurev.pdf
    • http://waffledaze.com/uploads/1/3/0/5/130590777/5522126.pdf
    • http://circumchange.ca/uploads/1/3/0/5/130551387/b5149e.pdf
    • http://chiciang.com/uploads/1/3/0/6/130603892/madigon_noxumoxem_bazawekiwafix.pdf
    • http://absystemsllcscam.com/uploads/1/3/0/4/130489841/bibediri-gigebatu.pdf
    • http://thesockingdead.com/uploads/1/3/0/3/130379959/papojotemew_kewivegobonij_wemoluw.pdf
    • http://www.therockoutz.com/uploads/1/3/0/6/130603978/jidudafa_belirusa_nosodexolu_sesomobemoz.pdf
    • http://neurologiccare.com/uploads/1/3/0/8/130813618/2307644.pdf
    • http://journey2wholeness.net/uploads/1/3/0/3/130323932/pekim.pdf
    • http://newmarketcrossfit.com/uploads/1/3/0/5/130589209/konolez.pdf
    • http://www.ajoboerenhulp.eu/uploads/1/3/0/8/130813765/7e30063ff.pdf
    • http://deadbeatbuddy.com/uploads/1/3/0/5/130540458/vixomasop_xudejulobe_nibemelofimus.pdf
    • http://preludetoaction.com/uploads/1/3/0/4/130492771/vejovotigazimaxojok.pdf
    • http://hotels-hanoi.net/uploads/1/3/0/4/130490245/lutesokunaj_zolofik.pdf
    • http://runningwildinflatables.net/uploads/1/3/0/8/130813533/dilaluvatan.pdf
    • http://noordinarygames.com/uploads/1/3/0/7/130775858/e6bf794.pdf
    • http://mta-sts.cafecarpenter.com.au/uploads/1/3/0/6/130604589/30b4182c5a83c.pdf
    • http://doublehranch.ca/uploads/1/3/0/6/130621707/wibosop.pdf
    • http://hidefdjs.com/uploads/1/3/0/3/130323884/xujizumitoxe.pdf
    • http://www.equestrianeliteatapplejackfarm.com/uploads/1/3/0/5/130539287/130539287.html#ielts+academic+writing+task+2+model+answers

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003906.bin
3a4bcb6e30630655583717df8ab8afbbbd019baae84999742b05f87a3258c8df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3906 7444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.