Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a915a4bc7b5d947…

MALICIOUS

PDF

44.1 KB Authoring application: Scribus First seen: 2020-09-15
MD5: 22991278a8a93e348e611a0e20e7f1e5 SHA-1: 095bbd5963dae7f0e6b16e7fc10438b694b24476 SHA-256: 5a915a4bc7b5d947fdfb2b5392fd526b879f9eb8244d50ca010a5e323a3f4d22
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which are to other PDF files, suggesting a link farm designed to distribute malicious content. The heuristic 'SE_PAYMENT_REDIRECT_LURE' indicates the document's content is designed to trick users into believing there are new or changed payment instructions, a common tactic in business email compromise attacks. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tattoovictoriatexas.com/uploads/1/3/0/4/130489240/tezunizoze_nibineterobe_zetibenokejuxor_dujokimifib.pdf In PDF document text
    • http://n4ewater.info/uploads/1/3/0/7/130775651/152d53cdfb.pdfIn PDF document text
    • http://bigislandpartyrentals.com/uploads/1/3/0/6/130621412/xusosipesapofurewoku.pdfIn PDF document text
    • http://reefnine.com/uploads/1/3/0/6/130621250/7291200.pdfIn PDF document text
    • http://bgooddesignllc.com/uploads/1/3/0/5/130550931/15eab.pdfIn PDF document text
    • http://createdbyrellyrel.com/uploads/1/3/0/5/130588668/wufupipelaxib-dorewerofidaj-nepim.pdfIn PDF document text
    • http://www.thevivaciouslivingcompany.com/uploads/1/3/0/5/130588556/dorubowowiniv-bamuduj-betudelepufop-vazapakulivatix.pdfIn PDF document text
    • http://mysmartptt.com/uploads/1/3/0/5/130544191/912428.pdfIn PDF document text
    • http://sugarfestbakersfield.com/uploads/1/3/0/3/130313488/wututug.pdfIn PDF document text
    • http://nottinghamkickboxing.com/uploads/1/3/0/4/130436154/laganokaluf-wikaku-jolati.pdfIn PDF document text
    • http://ddsbox.com/uploads/1/3/0/7/130739478/595238.pdfIn PDF document text
    • http://www.abigailtrejo.com/uploads/1/3/0/8/130874269/35a65f8.pdfIn PDF document text
    • http://ry4wn.bpmtc.com/uploads/1/3/0/4/130483215/130483215.html#asurion+sprint+insurance+policyIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000050ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50AC 9432 bytes
SHA-256: 9fc2fd82e93537c4f2e1c9907416fe6bdf61690f3fe244c6ac2a03b86a7c0803

Open this report in the interactive analyzer, or submit your own file for analysis.