Malicious PDF — malware analysis report

Static analysis result for SHA-256 26f9c6c84f918950…

MALICIOUS

PDF

33.5 KB Authoring application: Scribus
MD5: 7c37f3876aad70449b6ec55f03e9d7ef SHA-1: 72de950cf2d4ba92e48e82b4d5a81d50a8e8daf9 SHA-256: 26f9c6c84f9189505d584928dc8624b2967b8a15b161fa70e7f9f52a02c3ed63
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links likely serve as a link farm to redirect users to malicious sites. The ClamAV detection of Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.coffschamber.tdconx.com/uploads/1/3/0/6/130639152/mabaxuveko.pdf
    • http://acemenus.com/uploads/1/3/0/8/130874198/f2ed5.pdf
    • http://icantfocus.net/uploads/1/3/0/8/130874382/2127945.pdf
    • http://redcarpetfestival.com/uploads/1/3/0/4/130476818/pinas_vufofituli_bifakixami_fikak.pdf
    • http://castlepinesvillagegardenclub.org/uploads/1/3/0/7/130739129/wizugiroz.pdf
    • http://adulosangeles.com/uploads/1/3/0/7/130739522/nuvisizaw-refifijawoxi-levalirenifunu.pdf
    • http://davaoconstruction.com/uploads/1/3/0/2/130271001/480861.pdf
    • http://ladoniaherald.net/uploads/1/3/0/4/130477228/zujasut-kimekaweri-regenemeru.pdf
    • http://urbancampusresources.com/uploads/1/3/0/7/130739032/a97523281945962.pdf
    • http://www.gimmegolfbets.com/uploads/1/3/0/6/130620478/3565747.pdf
    • http://live4todayusa.org/uploads/1/3/0/6/130639474/130639474.html#bootstrap+form+group+file+upload

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ba8.bin
732918ad69eb6770b451784ce42a869245e9d6c19e9bd79e6b951ed0f7f64bd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2BA8 8272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.