Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a6dda78f3c19fd3…

MALICIOUS

PDF

61.6 KB Authoring application: Scribus
MD5: 7850586c5e1147355a9084ccf9653684 SHA-1: 5a83f261f94308a8f3c219b183f488bdef657bdb SHA-256: 1a6dda78f3c19fd334c257fb9f2be9d58123651ac7dd2cc14a8a6c7db3d40518
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm designed to attract traffic or distribute malicious content. The ClamAV detection of Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious intent. The document body itself contains a mix of seemingly random text and URLs, reinforcing the idea that the primary purpose is to redirect users to external sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://son.itechieguru.com/uploads/2020/01/29/bokebofiwodedu.pdf
    • http://ris.event55.ru/uploads/2020/01/28/4c22ec.pdf
    • http://mpunlimited.com/uploads/1/3/0/6/130620150/7570934.pdf
    • http://puertorican-bondlosses.com/uploads/1/3/0/2/130287506/6881621.pdf
    • https://lamigowa.weebly.com/uploads/1/3/0/5/130543870/bimupukawakuzutukas.pdf
    • http://biltmorecreations.com/uploads/1/3/0/6/130620609/9930100.pdf
    • http://beloxybkk.com/uploads/1/3/0/4/130483087/03c1fe69021.pdf
    • http://sauerlandhypotheek.nl/uploads/1/3/0/6/130603728/130603728.html#canon+pixma+mx494+software

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011d3.bin
7714e6567f0e09b946a44c1916953c576c66588ad819c0610ed883d14eb4f16d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D3 10084 bytes
font_01_sfnt_off0000727e.bin
dc26b8937c310af93f3c11127be12c5f9e3a2cfc1a64da48f7d7a19171c6137a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x727E 9704 bytes
font_02_sfnt_off000086fd.bin
5cdfc574663d91394f0d573e660624a5797d77a17c9578275d34ef62f2bd00ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x86FD 6908 bytes
font_03_sfnt_off00009cc8.bin
4c93801c4768b9cf34ec960e4f85d683fdbe353adcc5a9e70f9f8b41c5e92470		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9CC8 3508 bytes
font_04_sfnt_off0000a892.bin
6bceb9db573367e72871953832e0af020e51312636c67ac1c5fb3810f810bc76		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA892 16688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.