Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f83ad6307e9d8ae…

MALICIOUS

PDF

54.1 KB Authoring application: Scribus
MD5: e21bc88a1808c73cb40c728052095bea SHA-1: cb07b83641429c710e9791972c838925c03ce006 SHA-256: 1f83ad6307e9d8ae934d9782ef51888478da3d0e4e1962e1883aed1c5066de72
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body itself is heavily obfuscated and contains some of the URLs, reinforcing the lure to click on external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://afcitypark.com/uploads/1/3/0/5/130539393/4751261.pdf
    • http://naughtonsandblastinggalway.com/uploads/1/3/0/5/130544318/delos.pdf
    • http://sago.oprosniksell.xyz/uploads/2020/01/28/mabem-xarekakafusi-xozirapuvul-powewerunedik.pdf
    • http://merwininsurance.net/uploads/1/3/0/5/130588659/4763917.pdf
    • http://agentlemansartwork.com/uploads/1/3/0/5/130542734/f0cc07e377685cb.pdf
    • http://ashleighjane-adventure.net/uploads/1/3/0/5/130539085/7085a.pdf
    • http://youreventdecorator.com/uploads/1/3/0/2/130271229/83da9.pdf
    • http://nau-systems.com/uploads/1/3/0/2/130270938/banuxaz.pdf
    • http://msnenglish.net/uploads/1/3/0/6/130621149/8285538.pdf
    • http://metrowalkatlanta.org/uploads/1/3/0/5/130542971/kivegefalarako.pdf
    • http://mylifesreflections.com/uploads/1/3/0/6/130620387/dobesi.pdf
    • http://pathfinder-health.info/uploads/1/3/0/4/130476098/9594206.pdf
    • http://djsacademy.com/uploads/1/3/0/4/130435811/130435811.html#r+b+letter+whatsapp+status

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001342.bin
7df2fbd5605d14fceace429b35c9437f9dbd2a2b6ca3b34ac8d768aea6d4ea27		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1342 8508 bytes
font_01_sfnt_off00006e10.bin
cec7324466c285cd8d7a2e6a50ccf03f56c879cd8c83c7730a0071bdabbd4240		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E10 2836 bytes
font_02_sfnt_off00007986.bin
f2aa8fd4816aaf200063de28a8229b2f39bbe1d5f0d72890502d0d98d911d996		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7986 16672 bytes
font_03_sfnt_off00008fb9.bin
cba1f0a5a98a6fcb2af21863493edae81ce1ac6b6ec74924cd89e7d4bbe0ef00		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FB9 1416 bytes
font_04_sfnt_off0000971f.bin
1a03342157cd304f5a224812eb45a03ecb97cd10bca1366af9505797a8e4ddf9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x971F 3628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.