Malicious PDF — malware analysis report

Static analysis result for SHA-256 2299dd24e9a543ab…

MALICIOUS

PDF

37.1 KB Authoring application: Scribus
MD5: b0be892f7bb46cad43427850e7b5df32 SHA-1: 3f5a916897e90b3fdbc6f629d13e1f45c24e0ed0 SHA-256: 2299dd24e9a543ab9f21813d727d0b3fcf1dba6cd15597978682d91c229c25b0
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The PDF_SEO_LINK_FARM heuristic fired, revealing a large number of embedded external links, primarily pointing to other PDF files hosted on various domains. The primary domain observed is purpleketo.com. This suggests a phishing or SEO spam campaign designed to lure users to malicious content or manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://purpleketo.com/uploads/1/3/0/7/130738824/8123350.pdf
    • http://marketinginalbania.net/uploads/1/3/0/7/130739221/dc4d0c148.pdf
    • http://mx.peerlesscleaners.com/uploads/1/3/0/6/130621141/wapomebupulax-wogugisuse.pdf
    • http://nicolettamanusardicamicie.com/uploads/1/3/0/5/130590371/geboxida-woditimaxix-daletikofa.pdf
    • http://ebc3.org/uploads/1/3/0/2/130272254/1a051.pdf
    • http://rdhtempservices.com/uploads/1/3/0/5/130538996/ruxuw.pdf
    • http://blunderist.com/uploads/1/3/0/6/130621989/mugotizo.pdf
    • http://androidisfor.me/uploads/1/3/0/6/130639936/8811709.pdf
    • http://dominiondistillers.com/uploads/1/3/0/7/130738569/gojag_zoxevopanogowu_kozip.pdf
    • http://koekiecookie.com/uploads/1/3/0/2/130272898/3226651.pdf
    • http://roanokechoristers.com/uploads/1/3/0/5/130543333/kuruviresatomig-xaleru-zosalubale.pdf
    • http://atxbeers.com/uploads/1/3/0/6/130620965/9553426.pdf
    • http://www.learnadjustgrow.com/uploads/1/3/0/6/130605124/903022.pdf
    • http://www.ventanadwinc.davidmichaeldesigns.com/uploads/1/3/0/3/130379462/konime.pdf
    • http://bbodaciousfitness.com/uploads/1/3/0/6/130621108/5095128.pdf
    • http://tourdecroghan.com/uploads/1/3/0/6/130620781/273462454.pdf
    • http://missiodaily.org/uploads/1/3/0/6/130604233/1584221.pdf
    • http://williamfelts.com/uploads/1/3/0/4/130435846/pekavikavol.pdf
    • http://xamanismo.info/uploads/1/3/0/5/130544318/3518899.pdf
    • http://aspccc.com/uploads/1/3/0/7/130775866/4647615.pdf
    • http://navinatural.com/uploads/1/3/0/7/130776776/6374aac2697.pdf
    • http://pasquiasnowgoers.ca/uploads/1/3/0/2/130272478/2156291.pdf
    • http://ncaop.org/uploads/1/3/0/4/130488387/wetapalib_jizagarilove_fogogapexo.pdf
    • http://x0013959xstreamtravel.xsideas.com/uploads/1/3/0/6/130604366/130604366.html#calendar+2020+showing+week+numbers

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002dc8.bin
ef1a8f19e6e19ce7c6f0a8286fd3aff8953597929f912288fc82d544ac550aff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DC8 8272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.