Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecde51cb57262b2c…

MALICIOUS

PDF

35.9 KB Authoring application: Karbon
MD5: d181e1d85e6d95d73ba221e15294336f SHA-1: ceb2bda58ad6999e6bce819412eb72da9f43688d SHA-256: ecde51cb57262b2c7040bc8f8ce778f56a7b31a988786074f507a99718233a91
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, indicating a link farm or redirection scheme. This behavior is flagged by the PDF_SEO_LINK_FARM heuristic and ClamAV's Pdf.Phishing.TtraffRobotInstall signature. The document body, though heavily obfuscated, contains references to funeral flower card templates and includes many of the same URLs, suggesting a lure to disguise the malicious intent. The primary goal appears to be SEO manipulation or distributing malicious content via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nickelplatebarandgrill.com/uploads/1/3/0/5/130550834/6554944.pdf
    • http://mikaimtrading.co.za/uploads/1/3/0/5/130539223/dotilonukijir.pdf
    • http://ohhousecleaners.com/uploads/1/3/0/2/130287895/2106721.pdf
    • http://bayislandsoapco.com/uploads/1/3/0/6/130620348/dukukax-gelamalexokiz-jipajoziwofo-daram.pdf
    • http://canyoncitygrill.com/uploads/1/3/0/6/130639745/09056cf67f8c.pdf
    • http://michianawomeninconstruction.com/uploads/1/3/0/6/130620584/8e67598f2244c.pdf
    • http://danielshanethomas.com/uploads/1/3/0/6/130639025/begedufuwe.pdf
    • http://angelajobin.com/uploads/1/3/0/6/130621059/993efbd833.pdf
    • http://coolboymusic.us/uploads/1/3/0/6/130639105/pofaxeretununo.pdf
    • http://attorneyspacesharing.com/uploads/1/3/0/2/130289670/130289670.html#funeral+flower+card+template

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011e6.bin
cbfffc91e97f5ae23514d2a8e3e332ca1e9e6e22d42e0513a68560dbcc3a834a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E6 7836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.