Malicious PDF — malware analysis report

Static analysis result for SHA-256 0707171207c7a9e8…

MALICIOUS

PDF

52.8 KB Authoring application: Scribus
MD5: cff26145dbb93b40cac28fdb7b9900e0 SHA-1: e95e13d98f83e461dfc7e86f9689bb194b378fdc SHA-256: 0707171207c7a9e80e1cc7b4b1cb23593968520053da9c857f9d2a41af92e93f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm containing numerous external PDF URLs. The ML classifier also strongly indicated maliciousness. The embedded URLs suggest a phishing or malware distribution campaign, likely initiated via a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bljackson.com/uploads/1/3/0/2/130274281/5942314.pdf
    • http://cpcalendars.eckerle.co.za/uploads/1/3/0/8/130873787/9950502.pdf
    • http://topmetalsllc.com/uploads/1/3/0/2/130271240/xowijes.pdf
    • http://phantomofthepasta.com/uploads/1/3/0/5/130540208/45145d80e2897.pdf
    • http://elizabethbriskin.com/uploads/1/3/0/6/130605030/lokuwivijibubete.pdf
    • http://smokebrushfoundation.net/uploads/1/3/0/5/130550994/9260319.pdf
    • http://summerslam6s.com/uploads/1/3/0/5/130541351/pagezo.pdf
    • http://www.teamketo.ca/uploads/1/3/0/5/130539756/cf08cab710280.pdf
    • http://www.trymto.com/uploads/1/3/0/2/130272928/wufofubini_gonuli_kotopow_fititebesevugo.pdf
    • http://cinno.ca/uploads/1/3/0/6/130640051/kogezes_vinotoliri.pdf
    • http://treatui.com/uploads/1/3/0/6/130604731/956516.pdf
    • http://qwodo.com/uploads/1/3/0/5/130588261/919505691c0f39.pdf
    • http://turlurs.com/uploads/1/3/0/6/130621250/97f47c215c14.pdf
    • http://www.spacecreationdesign.com/uploads/1/3/0/3/130312934/130312934.html#arduino+esp8266+wifi+shield+schematic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fbd.bin
31eb177b7ac6c1334a3855290b55a7af790ebdec5735e85583447f012f349c9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBD 8608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.