Malicious PDF — malware analysis report

Static analysis result for SHA-256 1142bcb23b71e736…

MALICIOUS

PDF

43.3 KB Authoring application: Scribus
MD5: 4f5ffb5a958c9bf1a25dea2456fa1408 SHA-1: 6b75cd798e22b454e06f351eeea247019fbf9ca3 SHA-256: 1142bcb23b71e736f1312a7d22a33071a6ee7212136c0f9770e11dd772801fd1
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of links to external PDF files hosted on various domains, indicative of a link farm or phishing campaign. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly suggest malicious intent. No scripts were extracted, but the structure points towards a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tribelicious.com/uploads/1/3/0/4/130435682/3413184.pdf
    • http://cheapceramicknives.com/uploads/1/3/0/2/130287867/3657641.pdf
    • http://www.polish-publish.com/uploads/1/3/0/6/130604620/xigakedosinigim.pdf
    • http://desatascosbarcelona.net/uploads/1/3/0/7/130739968/wibibapo.pdf
    • http://myjeshop.com/uploads/1/3/0/7/130739284/7704383.pdf
    • http://margarete.net/uploads/1/3/0/6/130621552/371518.pdf
    • http://mta-sts.mail.fbchurch.ca/uploads/1/3/0/4/130436080/8ac8b0b6516a3.pdf
    • http://theearthfactoryllc.com/uploads/1/3/0/6/130604256/xerupexeto.pdf
    • http://www.albaboatsltd.com/uploads/1/3/0/9/130969942/c3cce422c.pdf
    • http://autodiscover.thepollardgallery.com/uploads/1/3/0/5/130588377/dffffd133.pdf
    • http://morrax.store/uploads/1/3/0/5/130539691/8591f3542a7516.pdf
    • http://onesimplyiris.com/uploads/1/3/0/7/130775958/a99200.pdf
    • http://couplingmanufacturers.com/uploads/1/3/0/7/130776698/nujozolelaxajuguseja.pdf
    • http://rainbowfamilycounseling.com/uploads/1/3/0/6/130620341/85796.pdf
    • http://premierbeachpropertymanagement.com/uploads/1/3/0/5/130590273/ralojijom_nobosogigago_foxukotolakun.pdf
    • http://adentamalaysia.com/uploads/1/3/0/6/130639565/vevosuginariwifa.pdf
    • http://fullcanopy.com/uploads/1/3/0/5/130588382/4807636.pdf
    • http://kyawomen.com/uploads/1/3/0/4/130483940/4816333.pdf
    • http://puertoricandj.com/uploads/1/3/0/7/130775848/tisikapazutip-pusaxixak-lixopupikerox-mewojubulakako.pdf
    • http://codebeforedawn.net/uploads/1/3/0/5/130588957/0001035a.pdf
    • http://sigmapivu.com/uploads/1/3/0/7/130740551/kekax.pdf
    • http://victoryamecaz.org/uploads/1/3/0/2/130288383/saleb_paxivoxaxo_fupuputi_mejefimakiruw.pdf
    • http://www.adriftwoodworks.com/uploads/1/3/0/8/130874615/nofojidu-nugexetegomaju-xamevunoro.pdf
    • http://74-123-73-134.mgwnet.com/uploads/1/3/0/7/130776817/130776817.html#buffalo+wild+wings+bar+menu+prices

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004551.bin
397fff421a981616a1e2e7362ead899d48218a3ccfa8a4b6c7653070cf0fea1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4551 8544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.