Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec06c0659d96aeb6…

MALICIOUS

PDF

38.8 KB Authoring application: Karbon
MD5: 6f3f5977b21a3baa2dbbfa9e1b2b3136 SHA-1: 2c2ce78cea6639accb78be029b612d0f3508cade SHA-256: ec06c0659d96aeb640c4d3d2a047afd00e9d9b5e7e0a3e669559e53c59373c47
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to drive traffic to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wecanimpressyou.com/uploads/1/3/0/2/130289541/fulanan.pdf
    • http://infinitybisect.com/uploads/1/3/0/6/130621488/3324841.pdf
    • http://bestestcasinos.com/uploads/1/3/0/3/130323268/wizoxezarel_pekerejob_kidazavuleg.pdf
    • http://qmobix.net/uploads/1/3/0/8/130815080/631005.pdf
    • http://coastaltest.club/uploads/1/3/0/5/130588517/4281b9a446.pdf
    • http://topcincinnatibeautysalontraining.com/uploads/1/3/0/5/130588980/1023339.pdf
    • http://baloyatees.com/uploads/1/3/0/6/130620897/7893858.pdf
    • http://aniaoliviapr.com/uploads/1/3/0/6/130621436/3014356.pdf
    • http://mkcpac.net/uploads/1/3/0/6/130620769/jowuzojurasiwamo.pdf
    • http://metrix-psy.com/uploads/1/3/0/2/130270895/kojosimaxuxul_wolato.pdf
    • http://dentalschoolaid.com/uploads/1/3/0/2/130289485/9336619.pdf
    • http://jymstringer.com/uploads/1/3/0/7/130739852/68fa1e21b0cc9.pdf
    • http://diradevelopments.com/uploads/1/3/0/4/130476078/2944467.pdf
    • http://colinaway.com/uploads/1/3/0/5/130550792/pamulux-zijasekaja.pdf
    • http://rubylencicki.com/uploads/1/3/0/7/130775166/gezavuxorip_xovopowemig_zavilutuxizug.pdf
    • http://sdesworks.org/uploads/1/3/0/5/130541837/e784a5526.pdf
    • http://owr.world/uploads/1/3/0/6/130620924/zidus-petewagovovuze-liloti.pdf
    • http://herbalalliance.org/uploads/1/3/0/4/130488197/vexosavozanovag_wosali_nesavozekezejov.pdf
    • http://08bbf7.com/uploads/1/3/0/2/130287867/ligajawiret_xetamonabe_pakevonabolez.pdf
    • http://phonetac.com/uploads/1/3/0/6/130639896/vewibesefuro.pdf
    • http://ifyr6.bpmtc.com/uploads/1/3/0/6/130621096/130621096.html#fifa+world+cup+2018+live+streaming+channels+today

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000036d1.bin
fb03e30f721a4b2e87a5a4b484f54e20177e5fc7c7beef8c8524ca5e00c9bd84		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36D1 8412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.