Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b9869526f4890fb…

MALICIOUS

PDF

68.9 KB Authoring application: Scribus
MD5: cc21dc860919bd3c668952fabd08fe20 SHA-1: 92de09ee239f291c043a3c8cbccc870483625ab5 SHA-256: 5b9869526f4890fbf26d90a2e86d4806bd598bc9ef7d0850714b0d542d8faf18
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting a critical heuristic for a large external PDF link farm. The document body, though heavily obfuscated, does not provide direct instructions, but the embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest a campaign to redirect users to numerous external PDF files. This pattern is often used for SEO poisoning or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.mastravel.es/uploads/1/3/0/5/130551006/92286e8c6.pdf
    • http://mostlytech.com/uploads/1/3/0/4/130483417/zufavelavod.pdf
    • http://nicholsonsbar.com/uploads/1/3/0/7/130738501/6397817.pdf
    • http://outdoorseconds.co.za/uploads/1/3/0/7/130776032/82d16c8b9241.pdf
    • http://rauricantelo.com/uploads/1/3/0/4/130483808/mosili-ladunifitax.pdf
    • http://mlbcruises.com/uploads/1/3/0/6/130621045/najosawivikidelu.pdf
    • http://theatrestudentunion.com/uploads/1/3/0/5/130588960/2670754.pdf
    • http://jmplaser.com/uploads/1/3/0/5/130551564/bigevofeziwufe-gatupimowe.pdf
    • http://sales15-ip-phone.pleasingfood.com/uploads/1/3/0/8/130813756/1186a4f2.pdf
    • http://imagecenterspa.com/uploads/1/3/0/4/130477455/padopimov_superopaxadasu.pdf
    • http://rsvptotony.com/uploads/1/3/0/3/130323163/9d32434911e3f6.pdf
    • http://robertdickstudionyc.com/uploads/1/3/0/6/130621874/1639452.pdf
    • http://movetoamendpdx.org/uploads/1/3/0/6/130620213/debenu-nigexoxa-lifejalewi.pdf
    • http://aammf.bpmtc.com/uploads/1/3/0/6/130604250/130604250.html#components+of+polyacrylamide+gel+electrophoresis
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016a2.bin
316388cccde6608d04c27ea99b7fb5f086a8b4ddd14cc58e8ba9b0fb357a6900		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16A2 9472 bytes
font_01_sfnt_off0000d391.bin
f596863827dff6f1eb0cec8e03420474b46bc028b871d6d20b638fea1854b243		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD391 2896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.