Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed9c187f31d55040…

MALICIOUS

PDF

45.2 KB Authoring application: Karbon
MD5: 8fd57e0a0b7fb4219a6be8822c9c3e3e SHA-1: 612db0320b85196f8c936d6704cc323816578160 SHA-256: ed9c187f31d5504080b1e31c847c931ff60c05263d7342e6e12a07a1d211b4d8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits a critical heuristic firing for a PDF SEO link farm, containing 31 external links. The ClamAV detection also flags it as malware, specifically 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded URLs are likely part of a phishing or traffic-driving scheme, aiming to redirect users to malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://academicenglishtutoring.org/uploads/1/3/0/7/130740512/7968711.pdf
    • http://richretreats.com/uploads/1/3/0/7/130775892/4760179.pdf
    • http://pastelazteca.com/uploads/1/3/0/6/130621839/rabemibu.pdf
    • http://scdelongsales.com/uploads/1/3/0/5/130544226/sisodawepojok.pdf
    • http://www.dog-equilibre.com/uploads/1/3/0/7/130739773/befevifumuzal_lefibubojuda_wefamefafa.pdf
    • http://the-hemp-life.com/uploads/1/3/0/6/130605002/vudimibadejoju.pdf
    • http://alniyatbellydance.com/uploads/1/3/0/5/130551700/dolulodo.pdf
    • http://mooderopah.co.uk/uploads/1/3/0/5/130589010/383055.pdf
    • http://vietthy.com/uploads/1/3/0/6/130604779/lovexan-bagamaketawepa.pdf
    • http://laurabeardart.net/uploads/1/3/0/6/130604395/fixelugi_pimeguz.pdf
    • http://studiodentisticosg.com/uploads/1/3/0/8/130814343/4f02166afa0b2f8.pdf
    • http://nevebros.net/uploads/1/3/0/4/130477533/4503242.pdf
    • http://satellitesessionsmusic.com.au/uploads/1/3/0/5/130589230/1067181.pdf
    • http://defragrancehouse.com/uploads/1/3/0/6/130604386/c313ca462.pdf
    • http://www.jmwhitley.com/uploads/1/3/0/4/130488153/5052943.pdf
    • http://nrcm.com.au/uploads/1/3/0/7/130740607/zubege.pdf
    • http://lebaijiaguojiyule.br3h.com/uploads/1/3/0/8/130814623/130814623.html#simple+definition+of+gender+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a25.bin
839606b1d5feb0fc2c209eef59e161ee02a1a78f7a008c1f3a65be91ead2bd26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A25 16480 bytes
font_01_sfnt_off0000538e.bin
176e08f1c02f88866bc2eed4224fb9e18a6e6d3af42462b53b60d231c5570817		 pdf-font-stream PDF embedded font (sfnt) at offset 0x538E 8800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.