Malicious PDF — malware analysis report

Static analysis result for SHA-256 28cf770331a634d9…

MALICIOUS

PDF

42.3 KB Authoring application: Scribus
MD5: a63c0b8d3ab4c403082ec7a0af0ed2b1 SHA-1: 3fc8d58383bdc2ae3a0210034890e8fa848a51e5 SHA-256: 28cf770331a634d99f97e5cd5db7a76bb96db8281ce1ac12e07e5823e3f6566b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support the malicious nature of this file. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://naturalrawgoodness.com/uploads/1/3/0/3/130379219/tusexedebu.pdf
    • http://spinningred.com/uploads/1/3/0/6/130639856/nuvesufivojer.pdf
    • http://sanowahyudiphotography.com/uploads/1/3/0/6/130621006/rikaxezulusag_gaxukefi_kuvurimatobuziw.pdf
    • http://dubaidesignsprint.com/uploads/1/3/0/2/130289686/3957686.pdf
    • http://missionhere.org/uploads/1/3/0/2/130270898/zexexikinuze.pdf
    • https://zopidudav.weebly.com/uploads/1/3/0/5/130590778/regekofatolokebade.pdf
    • http://parkplace-dublin.com/uploads/1/3/0/3/130323538/wuwiz.pdf
    • http://heartlandbotanical.com/uploads/1/3/0/5/130551558/8a295b.pdf
    • http://cutestcabins.com/uploads/1/3/0/4/130436236/eb32ce40a49.pdf
    • http://drashcraft.com/uploads/1/3/0/6/130621905/neruginunazituk-vutalip-bomijabam-silas.pdf
    • http://notquitenans.com/uploads/1/3/0/5/130550688/9c29e1e.pdf
    • http://brainspaceclassroom.com/uploads/1/3/0/2/130272979/vuxipalo.pdf
    • http://skinnytiffy.com/uploads/1/3/0/5/130545597/mumenumavonovo.pdf
    • http://muskogeemoon.com/uploads/1/3/0/6/130621897/nusegifup_segafebo_punupapexuxuge_sunadunejer.pdf
    • http://blockfortcolumbus.shop/uploads/1/3/0/4/130476720/6756038.pdf
    • https://xibevaniw.weebly.com/uploads/1/3/0/5/130589275/kaxukosotefosaki.pdf
    • http://ccamsolutions.com/uploads/1/3/0/5/130588747/9ead5f4de285.pdf
    • http://stgeorgestucco.com/uploads/1/3/0/2/130271224/461dc95dd1127ab.pdf
    • http://crazzynuts.com/uploads/1/3/0/6/130603945/donokopafofodolebo.pdf
    • http://mermaidfitnessbump.com/uploads/1/3/0/6/130604192/lerogozopo-konuv.pdf
    • http://iamthemuseum.com/uploads/1/3/0/3/130313459/zigavorigefosijevax.pdf
    • http://nashobavalleyextractco.com/uploads/1/3/0/5/130550688/130550688.html#places+please+puzzles

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016cd.bin
bd65874c56d33c33af4a1c1ce2bfe0a0ac2bcecb5f05cf861012c8c1c29e3015		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CD 9132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.