Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b91166b2b968278…

MALICIOUS

PDF

45.9 KB Authoring application: Scribus
MD5: ea31feb7d2999ac9102af80deb68e847 SHA-1: 29d2ca08029149aa9dbd959a6e9cfc31c1166f70 SHA-256: 3b91166b2b96827822649aa4f4f5ac740b3e879e198f5cbb460b63748e5c9ff2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files across various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and redirection nature of this file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://newparanormalsociety.com/uploads/1/3/0/2/130271117/doligegib-wutexadukepudos-paxelogesurovux.pdf
    • http://lafamiliaojeda.net/uploads/1/3/0/3/130313363/tugin-fawepoxewiki.pdf
    • http://takwenyatourssafarisltd.com/uploads/1/3/0/5/130543141/c8d4fb1782b9.pdf
    • http://mpcaa.net/uploads/1/3/0/3/130323624/2835840.pdf
    • http://mishareads.com/uploads/1/3/0/6/130620942/karirij.pdf
    • http://hello-baby-toys.com/uploads/1/3/0/7/130738978/8099084ddf70.pdf
    • http://thecardr.net/uploads/1/3/0/2/130289415/gatarojuwibazez.pdf
    • http://juliejesternewman.com/uploads/1/3/0/5/130550871/130550871.html#sims+4+wicked+perversions+download

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001355.bin
6d2e9449a8105d18862c75e873d5bef42f59523126b484ebb781b5a8366b932d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1355 8612 bytes
font_01_sfnt_off00005c59.bin
31acf47e8bafb4e6e547b10742cf0c2f7095cd19f8081a8ce4a5be3da9de8596		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C59 17092 bytes
font_02_sfnt_off00007454.bin
d5bac49d79a736773b902b0940606a355e4ff4df91b41e4b226f59f05e87fe31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7454 4252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.