Malicious PDF — malware analysis report

Static analysis result for SHA-256 1172a1b1d42bf840…

MALICIOUS

PDF

46.4 KB Authoring application: Scribus
MD5: a38e76e60ff529ad2635c959f321370e SHA-1: 8aa6995b82a277d9c91efe805cd8ccb49cda54de SHA-256: 1172a1b1d42bf8407dc993f85cfc7f7f1fc9c1df802f8b26bfc32d4b122d280f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links to other PDF files, disguised as a document about Aboriginal art. This behavior is indicative of a link farm or a phishing lure designed to redirect users to malicious content. The ClamAV detection and ML classifier further support its malicious nature, suggesting it's part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://shrinedads.com/uploads/1/3/0/2/130272421/xukawumedavurom_nozaz_sunafalejevope.pdf
    • http://milleniummobile.ca/uploads/1/3/0/6/130604322/2424338.pdf
    • http://minchatholdings.com/uploads/1/3/0/4/130435891/df4af439f6b3da7.pdf
    • http://nharmonycastingandtalent.com/uploads/1/3/0/5/130546457/vuxaguxupumikaz.pdf
    • http://tek-n.com/uploads/1/3/0/5/130551363/sikipa_tuvuxegupulix_movusuz_gavaw.pdf
    • http://threehappytails.com/uploads/1/3/0/3/130313525/5babbeca4bb.pdf
    • http://thestavergroup.com/uploads/1/3/0/4/130488362/towukatabaro-tovavof.pdf
    • http://rockymtnoverlandexpo.com/uploads/1/3/0/7/130739654/bejobo.pdf
    • http://sportsphysiolab.com/uploads/1/3/0/6/130639655/2bde29.pdf
    • http://reyal.co.uk/uploads/1/3/0/3/130323162/5c2ba1ec2.pdf
    • http://chewoncakes.com/uploads/1/3/0/3/130323453/130323453.html#aboriginal+art+symbols+and+meanings+pdf
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012a7.bin
d36ac91a653cd66a33870672df0c4bd3de21d42bee5538fe01df3d8fa8026f33		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A7 8348 bytes
font_01_sfnt_off00006e37.bin
1d1fa5121415f8f5353993473374918b9d2a38f433752094af4cce5d3be72c8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E37 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.