Malicious PDF — malware analysis report

Static analysis result for SHA-256 2992accbfc2d301b…

MALICIOUS

PDF

36.9 KB Authoring application: Scribus
MD5: ed1a23129d4b96261296b04e81da74f9 SHA-1: a28c68487e1c53297181ed8af4937b11e2d2d112 SHA-256: 2992accbfc2d301bd1d5cb83f9dd0acf0d9089c93458498c5a5203651905f3c8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The embedded URLs are likely used to redirect users to malicious sites or to manipulate search engine rankings. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kraftedcoffeellc.com/uploads/1/3/0/4/130483285/xasukidi-bololekal-luxosow-metesopabo.pdf
    • http://microml.com/uploads/1/3/0/2/130288416/bizofofikupubul_zobibepu_kodinigabanew_fudagubiluvum.pdf
    • http://coloradosungrown.com/uploads/1/3/0/5/130546804/sumutew.pdf
    • http://justkenosha.net/uploads/1/3/0/7/130739232/waxos_jukilipejano_dosaxules_xoxogu.pdf
    • http://bloodbrothersclub.club/uploads/1/3/0/5/130589072/wuvoderivadomu-vumavemofok-jifefuxu-kaniloseno.pdf
    • http://brewwber.com/uploads/1/3/0/7/130775033/vokazi.pdf
    • http://runforestrunclub.com/uploads/1/3/0/6/130604113/gunewiliwesej_mivima_kinefabaruvupa_sajetubip.pdf
    • http://aspoonfulsparkle.com/uploads/1/3/0/7/130740186/pigobutugev-rafubo-nedad.pdf
    • http://mybuildahome.com/uploads/1/3/0/3/130323818/baran_gugikoni.pdf
    • http://indianlakeoutpost.com/uploads/1/3/0/6/130639540/livolewokurimenumol.pdf
    • http://billelenbark.net/uploads/1/3/0/6/130621035/8776316.pdf
    • http://ktfrost.com/uploads/1/3/0/7/130739567/vovob.pdf
    • http://simplyessentiallife.com/uploads/1/3/0/2/130287394/2570790.pdf
    • http://legalinformatics.net/uploads/1/3/0/4/130436339/601950.pdf
    • http://sophiajamal.com/uploads/1/3/0/5/130550974/6879453.pdf
    • http://savvyoilsisters.com/uploads/1/3/0/6/130639377/e9233e.pdf
    • http://bcdcosmetics.com/uploads/1/3/0/3/130379317/kedozuwajuro.pdf
    • http://soselectrical.co.nz/uploads/1/3/0/4/130483513/5471834.pdf
    • http://402garage.com/uploads/1/3/0/7/130775735/edaab4de.pdf
    • http://gifhash.com/uploads/1/3/0/3/130379482/6662910.pdf
    • http://monstercalgary.com/uploads/1/3/0/4/130476076/kumajarapab.pdf
    • http://mopola.com/uploads/1/3/0/7/130776646/7a330ed8b53.pdf
    • http://chewoncakes.com/uploads/1/3/0/6/130639605/130639605.html#present+progressive+tense+passive+voice+exercises
    • http://legalinformatics.net/uploads/1/3/0/4/13043633

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ea4.bin
6f5b2328e693b12a61e034ede8407d8740b3e9be477f51927664c14b9935bd81		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EA4 7868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.