Malicious PDF — malware analysis report

Static analysis result for SHA-256 25567ed002d08241…

MALICIOUS

PDF

41.2 KB Authoring application: Scribus
MD5: 449a8c69aa38f33a6ab64b0cfcf2a1e4 SHA-1: 02fc03a05915c3d86aa79c9aa6d00390be1b8a75 SHA-256: 25567ed002d08241d07852438f01a6a2a6fdfcbbd82e120dd7d8788346c1fd2f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV with the signature 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a large number of embedded external links, indicating a potential link farm or distribution mechanism. The document body contains text related to asset management companies, which may serve as a lure. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://summitcityguitartraining.com/uploads/1/3/0/4/130478210/9543621.pdf
    • http://cmjlawn.com/uploads/1/3/0/7/130738950/9297857.pdf
    • http://wellnesslifestylelounge.com/uploads/1/3/0/5/130545011/tojajazeba_nogopuwili_dikeli_nadisubosavik.pdf
    • http://artispira.com/uploads/1/3/0/2/130292104/tuguliwuguj_vefogum_zubotinulabe.pdf
    • http://drcmullen.com/uploads/1/3/0/5/130550948/81402bad1c.pdf
    • http://anxietyfreepregnancy.com/uploads/1/3/0/3/130323493/vafinepazogi.pdf
    • http://raxofosule.uuqqprt.info/uploads/2020/01/28/23edb3.pdf
    • http://miracleinabucket.com/uploads/1/3/0/2/130289274/130289274.html#functions+of+asset+management+company+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001199.bin
a1113c3ce310444780cb3293cdab33cbc41081ad418d0afd6327a6a242cdfbb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1199 8416 bytes
font_01_sfnt_off00006648.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6648 2600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.