Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f6177f5ad050353…

MALICIOUS

PDF

34.3 KB Authoring application: Scribus
MD5: a3a44260ed47583fe7c87861057ea1a8 SHA-1: a68aab7ac237026709900ea3ba9469fa937eb6ee SHA-256: 3f6177f5ad050353c41b505ffcd46c695225e62207b55a460cb928868e61eaca
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. The heuristic PDF_SEO_LINK_FARM indicates a large number of external PDF links, with the primary one being http://kidskeepcharlestonclean.org/uploads/1/3/0/6/130640040/nazojigiso_lowawor.pdf. This suggests the document is likely part of a phishing or SEO spam campaign, directing users to other malicious or deceptive PDF files.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kidskeepcharlestonclean.org/uploads/1/3/0/6/130640040/nazojigiso_lowawor.pdf
    • https://jiwakefe.weebly.com/uploads/1/3/0/4/130483918/vajoloxa-nowija.pdf
    • http://ruziwa.sekrie.ru/uploads/2020/01/29/2345036.pdf
    • http://shymiahchanelextensions.com/uploads/1/3/0/5/130539866/jusavuwovovunuru.pdf
    • http://mayahairstonslampoetry.com/uploads/1/3/0/6/130604449/3301943.pdf
    • https://jimodudidifuv.weebly.com/uploads/1/3/0/5/130588499/kofok-jimuzu-sosaz-donenajabe.pdf
    • http://keystonewildcatssoftball.com/uploads/1/3/0/6/130605167/kajofiwijepovoz.pdf
    • http://kifuxafuxe.maska.org/uploads/2020/01/27/7e4582394d7.pdf
    • https://zadoxuvavupuso.weebly.com/uploads/1/3/0/4/130476669/kalaret_telezod_bazusibigubiga.pdf
    • http://adamrichardsteachingportfolio.com/uploads/1/3/0/2/130291474/xajemuvadalapux.pdf
    • http://tapi.indieban.com/uploads/2020/01/29/8999805.pdf
    • http://fora.majesticpin.site/uploads/2020/01/28/laxirave_nogejetotupede.pdf
    • http://dns-oldi-nix.info/uploads/2020/01/27/6007697.pdf
    • http://lexupo.sloto-cash.ru/uploads/2020/01/28/vonokobenumarow.pdf
    • http://babuxe.vipiski-online6.icu/uploads/2020/01/29/xefigirobara.pdf
    • http://kibeweg.yusufkalayci.com/uploads/2020/01/29/vofiti_kawodoliz_pexovabepip.pdf
    • http://mrsmeltabargersclass.com/uploads/1/3/0/5/130539325/gawikinoruf.pdf
    • http://suxiwe.antizavtra.ru/uploads/2020/01/28/3158099.pdf
    • http://kojo.denem3131.com/uploads/2020/01/27/lepudugul.pdf
    • http://xudomanu.podrochim.online/uploads/2020/01/27/9ec0e7841a69284.pdf
    • http://stevenderidder.com/uploads/1/3/0/5/130589345/130589345.html#affaire+xavier+dupont+de+ligonn%C3%A8s+reportage

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016c8.bin
ee9b158512c75a88bcb1efa687d9ae73ae9d2dcf0290ace1215b202f651096cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16C8 9676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.