Malicious PDF — malware analysis report

Static analysis result for SHA-256 2bf409420c744c78…

MALICIOUS

PDF

40.0 KB Authoring application: Scribus First seen: 2020-09-24
MD5: 17ff96f2f0263503b23e9fdeab5fc6a9 SHA-1: 3092c928a3d544fcb369b86420a55dedfbbad637 SHA-256: 2bf409420c744c78c230ba1e324bae86dd6e3dafd21c5872e70239554993b564
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, indicating a link farm designed to redirect users. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly suggest malicious intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external links, with 'redmonsterconsulting.com' being a dominant host. No scripts were extracted, but the structure and URL distribution are indicative of a phishing or redirection campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://redmonsterconsulting.com/uploads/1/3/0/6/130621776/8561786.pdf In PDF document text
    • http://murphcooper.com/uploads/1/3/0/6/130605196/fakemitefowogu.pdfIn PDF document text
    • http://mmalifestyler.com/uploads/1/3/0/7/130776105/ruwepoxeri-zizizano-vawiketuwowodat.pdfIn PDF document text
    • http://jetherington.com/uploads/1/3/0/7/130776351/zurebavixax-basilozatasu.pdfIn PDF document text
    • http://constancehsb.com/uploads/1/3/0/8/130814515/dbd53a7e5754.pdfIn PDF document text
    • http://errqre.com/uploads/1/3/0/2/130291531/bc22e73d6ff9.pdfIn PDF document text
    • http://geigerair.com/uploads/1/3/0/7/130740183/3512001.pdfIn PDF document text
    • http://cmtrader.net/uploads/1/3/0/8/130874222/e3e45d673c.pdfIn PDF document text
    • http://seasonalswap.com/uploads/1/3/0/7/130739132/mibewow.pdfIn PDF document text
    • http://www.teen-works.com/uploads/1/3/0/4/130476505/3b0bbc31de.pdfIn PDF document text
    • http://sheilaberger.com/uploads/1/3/0/7/130776336/raxerulativat.pdfIn PDF document text
    • http://www.kennyosborne.com/uploads/1/3/0/2/130289682/1761f11ee127e.pdfIn PDF document text
    • http://zyonstrategies.com/uploads/1/3/0/3/130379504/4c9ecfd902873e.pdfIn PDF document text
    • http://thehealthychocolateshop.com/uploads/1/3/0/2/130289734/2244483.pdfIn PDF document text
    • http://coachharrisbiologywebsite.com/uploads/1/3/0/4/130488547/zegibaxitumi_lamak_toxebopab_bawinano.pdfIn PDF document text
    • http://mail.mypersuasions.com/uploads/1/3/0/2/130287296/4022792.pdfIn PDF document text
    • http://lunaparkstudio.net/uploads/1/3/0/5/130588928/sezakilodo.pdfIn PDF document text
    • http://tourbillonart.com/uploads/1/3/0/5/130551130/soxatexepijatirasas.pdfIn PDF document text
    • http://pittmanguitars.com/uploads/1/3/0/5/130542728/8059333.pdfIn PDF document text
    • http://osbaonline.com/uploads/1/3/0/8/130874648/xulinigi_jezizafifovafiz_vuridejup.pdfIn PDF document text
    • http://micrusade.com/uploads/1/3/0/4/130483204/4686858.pdfIn PDF document text
    • http://jaxalphabetphoto.com/uploads/1/3/0/5/130550741/nafititesikimuk_luxonasenok_nejaped.pdfIn PDF document text
    • http://dux-plex.com/uploads/1/3/0/5/130551287/nulomunalifedarexi.pdfIn PDF document text
    • http://74-123-72-189.mgwnet.com/uploads/1/3/0/5/130540214/130540214.html#occipital+nerve+block+trigger+point+injectionIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
🗂 Part of campaign: geigerair.com 5 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002dee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DEE 1576 bytes
SHA-256: 0efc485bfecffc3e9ad601ef019a4ed7c4acd3ce5dcf48e6d21f45b21f0bad0f
font_01_sfnt_off0000384c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x384C 8268 bytes
SHA-256: 1ab94cd3236c4286dd189d063ec816bc8d0ea3d7ef1ea0c7fc04be0efcb076d5

Open this report in the interactive analyzer, or submit your own file for analysis.