Malicious PDF — malware analysis report

Static analysis result for SHA-256 463938f7ed779fdf…

MALICIOUS

PDF

59.8 KB Authoring application: Scribus
MD5: 0471b6205e1b5eeea7fedf6bb5885360 SHA-1: f472175f00947328479e473ab2b563588c823a0e SHA-256: 463938f7ed779fdfb0fc395b54605ac215d87f9aecf187f24c4445537e714385
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule, indicating a large number of external links. The ML classifier also assigned a high probability of maliciousness. The embedded URLs suggest a link farm or phishing campaign designed to redirect users to potentially malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nautifoods.com/uploads/1/3/0/6/130604885/mirepas-vemonutuju.pdf
    • http://mojaveoffroadadventures.com/uploads/1/3/0/6/130639681/nubijejobomu-juxadagop-jukikujomonezu.pdf
    • http://provisionmediausa.com/uploads/1/3/0/3/130323526/60348e00e177a64.pdf
    • http://whiddenprinting.com/uploads/1/3/0/6/130604147/sovibilominif.pdf
    • http://reddiamondbenefits.com/uploads/1/3/0/2/130271038/6926092.pdf
    • http://salaam-art.nl/uploads/1/3/0/5/130539846/pijugesomaw.pdf
    • http://myprovidenceconstruction.com/uploads/1/3/0/5/130551262/1395489.pdf
    • http://allbodiesbeautiful.com/uploads/1/3/0/3/130323268/xinoxev.pdf
    • http://mobileonegaming.com/uploads/1/3/0/6/130604640/4238620.pdf
    • http://dbtdelaware.com/uploads/1/3/0/5/130544687/7644649.pdf
    • http://blackpearltattoosupply.com/uploads/1/3/0/5/130539797/3588756.pdf
    • http://acandleaffairbyangela.com/uploads/1/3/0/2/130272903/4044920.pdf
    • http://michaelshusko.com/uploads/1/3/0/7/130776702/130776702.html#bacaan+surah+yasin+yang+paling+merdu+mp3

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00009028.bin
8a80ce9e65fc58822c43e9139addb9117602c06288dd4387aa02a543112a54c3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9028 25028 bytes
font_00_sfnt_off00001335.bin
6735863b7688bed07b2ebe71e606ab159137674c6cb78ff2cb5d7b730db3120b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1335 8440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.