Malicious PDF — malware analysis report

Static analysis result for SHA-256 36db034020a671ba…

MALICIOUS

PDF

33.7 KB Authoring application: Scribus
MD5: 1e432aadefa89de96e90477fe911b0e6 SHA-1: abd3a410577eb136395eb8925176d33a165e8131 SHA-256: 36db034020a671bade53a2143c0bd54dd14fdea915604af497710d8de31c5c60
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified as a link farm. The heuristic 'SE_PAYMENT_REDIRECT_LURE' indicates the document's content is designed to trick users into believing there are new payment instructions, a common tactic in business email compromise. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature. The primary attack pattern involves directing users to external URLs, likely for phishing or malware distribution.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://missiononce.org/uploads/1/3/0/4/130435726/1385529.pdf
    • http://missinglinkbrewing.co.uk/uploads/1/3/0/7/130775518/tavisaku.pdf
    • http://jimandcarolgarlow.com/uploads/1/3/0/2/130288939/wipuxuru.pdf
    • http://getitgatorauto.com/uploads/1/3/0/5/130588703/sotigozuweb.pdf
    • http://cheshuntteamministry.org/uploads/1/3/0/6/130604327/govunu.pdf
    • http://jamesmcleodvoice.com/uploads/1/3/0/7/130739575/puzerikofe_pakoxopafirisip_botopibebowuku_rukepe.pdf
    • http://www.art-of-dreams.de/uploads/1/3/0/6/130604612/4332653.pdf
    • http://danceofthemagi.com/uploads/1/3/0/6/130639335/wonaxodomatabevem.pdf
    • http://www.slayem.net/uploads/1/3/0/5/130545597/1877820.pdf
    • http://saxtonresources.co.uk/uploads/1/3/0/6/130621596/7048bb3c73322.pdf
    • http://cmedillustrations.com/uploads/1/3/0/3/130313379/ramuzekakak.pdf
    • http://www.toadandpickle.com/uploads/1/3/0/6/130604748/4275905.pdf
    • http://aimrace.org/uploads/1/3/0/6/130622011/pezam-divowexazojujef-sejaxemuwowe-gigapikunawewu.pdf
    • http://iamjeffsmith.com/uploads/1/3/0/2/130289784/feter.pdf
    • http://hostmaster.aelitasattic.org/uploads/1/3/0/6/130604382/86a6472db.pdf
    • http://marketreport.info/uploads/1/3/0/5/130588575/bifadozevikuxa.pdf
    • http://vodkajuicediet.com/uploads/1/3/0/6/130604520/4039118.pdf
    • http://ragecola.com/uploads/1/3/0/5/130588872/vudagepopetatepafes.pdf
    • http://mobilebillboardspaloalto.com/uploads/1/3/0/7/130774982/seviwifoliwup.pdf
    • http://newtraditioncoffee.net/uploads/1/3/0/6/130621193/zogegameji_latowala_tepejapoga_xujasawagol.pdf
    • http://mail.murphyschool.com/uploads/1/3/0/3/130323392/vemelidimil-kuwinegunera-wekovazemibe.pdf
    • http://nubianstriders.com/uploads/1/3/0/3/130379078/ea9b047f7a.pdf
    • http://astrosrestaurant.ca/uploads/1/3/0/9/130969279/zegofuver_togolanumirefex_jibizivokikimik.pdf
    • http://topecigarettereviews.com/uploads/1/3/0/7/130740086/nolopuxaj.pdf
    • http://greatdynasty.net/uploads/1/3/0/5/130550750/7088910.pdf
    • http://fancher-sisters.rominastiebenphotography.com/uploads/1/3/0/8/130813770/130813770.html#map+of+westeros+blanket
    • http://astrosre

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001e30.bin
eab849c153fa72060501986692c11027ed2c1395aff290047266a021ffc73281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E30 7964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.