Malicious PDF — malware analysis report

Static analysis result for SHA-256 51dca84f7189f26a…

MALICIOUS

PDF

41.8 KB Authoring application: Scribus
MD5: 4b3c02e059400f89b2ba97c874e1b20b SHA-1: e2e6784ce51443323bb6a9c8b94fa52877e9e9be SHA-256: 51dca84f7189f26ac4345a54f2cc298c94a17d3ea0a68a862b3bec76dce046c5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO poisoning attack, aiming to redirect users to potentially malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the malicious classification. No scripts were extracted from this sample, limiting the analysis of its specific payload delivery mechanism.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.troutlilycoffee.com/uploads/1/3/0/6/130604207/repazusumup.pdf
    • http://www.hairbyellieand.co/uploads/1/3/0/2/130291996/midix.pdf
    • http://campdogdesign.com/uploads/1/3/0/2/130289541/molijuj.pdf
    • http://streetwalkers.club/uploads/1/3/0/4/130476309/kutokobek.pdf
    • http://sunkenmine.com/uploads/1/3/0/5/130590413/bitalewizi-ravafalamuge.pdf
    • http://warwickcarriagedriving.com/uploads/1/3/0/5/130542831/jefemukaxapiwo.pdf
    • http://www.amdwriting.com/uploads/1/3/0/6/130621709/vozudawimor-davibupibepo.pdf
    • http://domainesaintmichel-provence.com/uploads/1/3/0/5/130551882/vidoga-bewewawogisam-wapaf-lolawagomibut.pdf
    • http://babacoolpc.com/uploads/1/3/0/3/130379718/a7ddba98.pdf
    • http://lakesideassembly.net/uploads/1/3/0/6/130639030/4e6cb37e.pdf
    • http://cares3dlab.com/uploads/1/3/0/6/130603767/xisijize.pdf
    • http://thediningroom745.com/uploads/1/3/0/4/130483759/xoxofe-fuzitileda-libuzutaguvobi.pdf
    • http://ants.org/uploads/1/3/0/3/130379143/52a7bbae82986.pdf
    • http://apexfive.org/uploads/1/3/0/4/130488884/475b779.pdf
    • http://www.harmonyfitnesspns.com/uploads/1/3/0/6/130605346/9866632.pdf
    • http://rivendellberry.com/uploads/1/3/0/5/130588980/8532003.pdf
    • http://barefootblessing.com/uploads/1/3/0/6/130621405/kezobuf-dininubi-xinew.pdf
    • http://adsl-63-204-18-50.benefitplans.org/uploads/1/3/0/2/130271083/130271083.html#acog+gestational+diabetes+mellitus

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000046ef.bin
7197ab147341beb569b7678d7dbb82189f526a021a04d505d960af54d4484c52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x46EF 8004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.