Malicious PDF — malware analysis report

Static analysis result for SHA-256 fed5fa6956c3177a…

MALICIOUS

PDF

37.9 KB Authoring application: Karbon
MD5: c18be3a02c1374578dd063ab769d3509 SHA-1: a0d5f363201836483302ceb52f4719d57df6dd22 SHA-256: fed5fa6956c3177a17e73d1c458e08d3bb9b054732bf2d46d2775491ccb2b0a7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm containing numerous external URLs. The ML classifier also strongly indicated maliciousness. The embedded URLs are likely used to redirect users to malicious sites, a common tactic for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cosmixmovies.com/uploads/2020/01/27/5086744.pdf
    • https://jafodugi.weebly.com/uploads/1/3/0/5/130539759/popefisova-pejomawofogud-lamisudiz.pdf
    • http://myelizabethsanchez.com/uploads/1/3/0/4/130476469/3252330.pdf
    • http://ayospinasradio.weebly.com/uploads/1/3/0/3/130313445/pujix.pdf
    • http://heartofachildministries.net/uploads/1/3/0/3/130379204/5ff6cc5b883.pdf
    • http://aysenurguler.com/uploads/1/3/0/4/130483678/9470573.pdf
    • http://sspowersolutions.com/uploads/1/3/0/3/130379287/wabokuwiwatut.pdf
    • http://werajidinu.agicole-acces.com/uploads/2020/01/29/fc554e3e.pdf
    • http://nomadicescaperoom.com/uploads/1/3/0/6/130604688/130604688.html#acute+otitis+media+and+chronic+otitis+media

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001373.bin
7c747a946308c8abe01be6da9ac8c21391693760501212913ea9017dc31d5442		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1373 7780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.