Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b9869526f4890fb…

MALICIOUS

PDF

68.9 KB Authoring application: Scribus First seen: 2020-09-07
MD5: cc21dc860919bd3c668952fabd08fe20 SHA-1: 92de09ee239f291c043a3c8cbccc870483625ab5 SHA-256: 5b9869526f4890fbf26d90a2e86d4806bd598bc9ef7d0850714b0d542d8faf18
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting a critical heuristic for a large external PDF link farm. The document body, though heavily obfuscated, does not provide direct instructions, but the embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest a campaign to redirect users to numerous external PDF files. This pattern is often used for SEO poisoning or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.mastravel.es/uploads/1/3/0/5/130551006/92286e8c6.pdf In PDF document text
    • http://mostlytech.com/uploads/1/3/0/4/130483417/zufavelavod.pdfIn PDF document text
    • http://nicholsonsbar.com/uploads/1/3/0/7/130738501/6397817.pdfIn PDF document text
    • http://outdoorseconds.co.za/uploads/1/3/0/7/130776032/82d16c8b9241.pdfIn PDF document text
    • http://rauricantelo.com/uploads/1/3/0/4/130483808/mosili-ladunifitax.pdfIn PDF document text
    • http://mlbcruises.com/uploads/1/3/0/6/130621045/najosawivikidelu.pdfIn PDF document text
    • http://theatrestudentunion.com/uploads/1/3/0/5/130588960/2670754.pdfIn PDF document text
    • http://jmplaser.com/uploads/1/3/0/5/130551564/bigevofeziwufe-gatupimowe.pdfIn PDF document text
    • http://sales15-ip-phone.pleasingfood.com/uploads/1/3/0/8/130813756/1186a4f2.pdfIn PDF document text
    • http://imagecenterspa.com/uploads/1/3/0/4/130477455/padopimov_superopaxadasu.pdfIn PDF document text
    • http://rsvptotony.com/uploads/1/3/0/3/130323163/9d32434911e3f6.pdfIn PDF document text
    • http://robertdickstudionyc.com/uploads/1/3/0/6/130621874/1639452.pdfIn PDF document text
    • http://movetoamendpdx.org/uploads/1/3/0/6/130620213/debenu-nigexoxa-lifejalewi.pdfIn PDF document text
    • http://aammf.bpmtc.com/uploads/1/3/0/6/130604250/130604250.html#components+of+polyacrylamide+gel+electrophoresisIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16A2 9472 bytes
SHA-256: 316388cccde6608d04c27ea99b7fb5f086a8b4ddd14cc58e8ba9b0fb357a6900
font_01_sfnt_off0000d391.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD391 2896 bytes
SHA-256: f596863827dff6f1eb0cec8e03420474b46bc028b871d6d20b638fea1854b243

Open this report in the interactive analyzer, or submit your own file for analysis.