Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a915a4bc7b5d947…

MALICIOUS

PDF

44.1 KB Authoring application: Scribus
MD5: 22991278a8a93e348e611a0e20e7f1e5 SHA-1: 095bbd5963dae7f0e6b16e7fc10438b694b24476 SHA-256: 5a915a4bc7b5d947fdfb2b5392fd526b879f9eb8244d50ca010a5e323a3f4d22
200 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm of 24 external PDF URLs, strongly suggesting a phishing or redirection attempt. The heuristic SE_PAYMENT_REDIRECT_LURE indicates the document's content is designed to trick users into changing payment details. Although no scripts were explicitly extracted, the presence of numerous embedded URLs points to a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tattoovictoriatexas.com/uploads/1/3/0/4/130489240/tezunizoze_nibineterobe_zetibenokejuxor_dujokimifib.pdf
    • http://n4ewater.info/uploads/1/3/0/7/130775651/152d53cdfb.pdf
    • http://bigislandpartyrentals.com/uploads/1/3/0/6/130621412/xusosipesapofurewoku.pdf
    • http://reefnine.com/uploads/1/3/0/6/130621250/7291200.pdf
    • http://bgooddesignllc.com/uploads/1/3/0/5/130550931/15eab.pdf
    • http://createdbyrellyrel.com/uploads/1/3/0/5/130588668/wufupipelaxib-dorewerofidaj-nepim.pdf
    • http://www.thevivaciouslivingcompany.com/uploads/1/3/0/5/130588556/dorubowowiniv-bamuduj-betudelepufop-vazapakulivatix.pdf
    • http://mysmartptt.com/uploads/1/3/0/5/130544191/912428.pdf
    • http://sugarfestbakersfield.com/uploads/1/3/0/3/130313488/wututug.pdf
    • http://nottinghamkickboxing.com/uploads/1/3/0/4/130436154/laganokaluf-wikaku-jolati.pdf
    • http://ddsbox.com/uploads/1/3/0/7/130739478/595238.pdf
    • http://www.abigailtrejo.com/uploads/1/3/0/8/130874269/35a65f8.pdf
    • http://ry4wn.bpmtc.com/uploads/1/3/0/4/130483215/130483215.html#asurion+sprint+insurance+policy

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000050ac.bin
9fc2fd82e93537c4f2e1c9907416fe6bdf61690f3fe244c6ac2a03b86a7c0803		 pdf-font-stream PDF embedded font (sfnt) at offset 0x50AC 9432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.