Malicious PDF — malware analysis report

Static analysis result for SHA-256 5523a45367fa924f…

MALICIOUS

PDF

46.3 KB Authoring application: Scribus
MD5: 7c168e2abcfb3b26c72bf9c6973558fb SHA-1: 0693d082723a7ee18d5a9becaaffa12cf651bcf8 SHA-256: 5523a45367fa924fbabe777ea477c51f1078a26744fc0feeb6a98b366889988a
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This strongly suggests a phishing or SEO poisoning attack, aiming to redirect users to malicious content or manipulate search results. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hog2018.com/uploads/1/3/0/5/130588802/kovojevokuremen.pdf
    • http://mta-sts.mx.stage-systems.com/uploads/1/3/0/9/130969166/1152181.pdf
    • http://andrewschall.com/uploads/1/3/0/4/130488295/6821378.pdf
    • http://angelightenterprises.com/uploads/1/3/0/5/130543653/1694827.pdf
    • http://kompete.net/uploads/1/3/0/6/130621479/a19ee1e51abf.pdf
    • http://szconstructionweimartx.com/uploads/1/3/0/4/130483253/muneb_nedeketizonovip.pdf
    • http://hostmaster.coregenicgroup.co.uk/uploads/1/3/0/5/130543133/xifavodezipe.pdf
    • http://hostmaster.kayakingforcharity.co.uk/uploads/1/3/0/5/130551518/8565358.pdf
    • http://www.therelationalmind.com/uploads/1/3/0/4/130435531/9456249.pdf
    • http://sgconsultation.com/uploads/1/3/0/5/130542907/cc316247e.pdf
    • http://longwoodhomesforsale.net/uploads/1/3/0/7/130740363/6157070.pdf
    • http://mpowerempire.com/uploads/1/3/0/7/130775288/5662233.pdf
    • http://extraordinarytroupe.com/uploads/1/3/0/5/130543476/2640132.pdf
    • http://trumpdisciple.com/uploads/1/3/0/4/130477420/savokojiwabofopusipe.pdf
    • http://skatefiction.com/uploads/1/3/0/5/130551770/7521766.pdf
    • http://www.ritmischgym.com/uploads/1/3/0/3/130324065/siwona.pdf
    • http://starbucksfs.net/uploads/1/3/0/7/130776017/zajefotuguneme.pdf
    • http://lawrenceandhazen.com/uploads/1/3/0/3/130323286/fesax.pdf
    • http://memoriesforever.voyagerwebsites.com/uploads/1/3/0/5/130546354/130546354.html#pantoea+agglomerans+symptoms
    • http://kompete.net/uploads/1/3/0/6/130621479/a19ee1e51abf.pd

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c4a.bin
b3affdfdfee497c2d3230853582529cf395d265bfdbb8cde7d84ae9c33602211		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C4A 16036 bytes
font_01_sfnt_off000053e1.bin
1fd53edc8c59bb61b280add432f4c7f8e4078dcd39c63c8791fe59686de9f6e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x53E1 9436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.