Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f2a37de3b40e881…

MALICIOUS

PDF

59.6 KB Authoring application: Scribus
MD5: dcc8120762502b4e025f8c9ccd9335a7 SHA-1: 3bb3a32cf8ea9e03c3644fa03710f70efd4482ef SHA-256: 2f2a37de3b40e8811cf04c7e945f476ff6ff83130005c97217dd0f65df364184
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, for malicious content. The critical PDF_SEO_LINK_FARM heuristic indicates a large number of external links, with the first identified URL being http://emiratescabincrew.co.uk/uploads/1/3/0/5/130545434/napul-nojanatavumita-vipatosupuwe-fikake.pdf. This suggests the document's primary purpose is to act as a lure, directing users to potentially harmful external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://emiratescabincrew.co.uk/uploads/1/3/0/5/130545434/napul-nojanatavumita-vipatosupuwe-fikake.pdf
    • http://moonlightairfoundation.org/uploads/1/3/0/6/130604276/15e9bda48b60acd.pdf
    • http://thesummitx.com/uploads/1/3/0/5/130546497/zetomev_nuxolupiwo_burafebelomev.pdf
    • http://rolandandcaroline.com/uploads/1/3/0/3/130379272/wigafemodeja.pdf
    • http://diybridalacademy.com/uploads/1/3/0/6/130620927/860291ad47898.pdf
    • http://andrewthompsonsongs.com/uploads/1/3/0/5/130589004/2776727.pdf
    • http://taideinto.com/uploads/1/3/0/7/130776222/66261.pdf
    • http://nickdeanconsulting.com/uploads/1/3/0/4/130476403/9607546.pdf
    • http://buckhillcoffee.com/uploads/1/3/0/6/130620909/derujetutal.pdf
    • http://navasotaminerals.com/uploads/1/3/0/3/130323401/2899980.pdf
    • http://lalogodesigner.com/uploads/1/3/0/3/130323106/3257916.pdf
    • http://bartolomeilaw.com/uploads/1/3/0/8/130874183/130874183.html#freundlich+adsorption+isotherm+ppt

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001382.bin
d188cb875008ad2ca248c8c398e352a5a874a407c64fe6d8826f3fb7cc1a2ca9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1382 9232 bytes
font_01_sfnt_off00008f45.bin
019bfe7d2d26446e11b96ab8a2f7bb7b8b845b08d248b92840400d1836a73571		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F45 3060 bytes
font_02_sfnt_off0000997f.bin
e0b773925efa0c9886d80b64ab4a8bae2ea7cd88a0f80919123736c22da4834a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x997F 16252 bytes
font_03_sfnt_off0000aead.bin
a8964e257fb33b0f1c3e7d7e7199771c789798b2e737ff97e9902de09a737ee9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAEAD 2096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.