Malicious PDF — malware analysis report

Static analysis result for SHA-256 634dc11eb61a6767…

MALICIOUS

PDF

38.4 KB Authoring application: Scribus First seen: 2020-09-24
MD5: db46049f12a311f97196ad9829459478 SHA-1: 9f7ae960ca9a0cfc765dcbaa1b491227990e2711 SHA-256: 634dc11eb61a67670d194311b4c25e90860135de5ff5985d7e101d68a6bc8e3f
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are disguised as secure documents, a common tactic for phishing or malware distribution. The heuristic 'SE_ENCRYPTED_DOC_LURE' specifically indicates a lure for fake encrypted documents, pointing to a malicious intent. ClamAV also detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', confirming its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake encrypted/secure-document view lure high SE_ENCRYPTED_DOC_LURE
    Document claims to be an encrypted or protected file that must be opened through a 'secure view' link, and the action link uses deceptive infrastructure. This is the secure-document credential-phishing carrier: the page imitates a secure-mail / document-cloud gate while the link leads to a harvesting site. action link to abused redirector.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://truurelief.com/uploads/1/3/0/2/130289393/9181726.pdf In PDF document text
    • http://oasisgaminginc.com/uploads/1/3/0/6/130639308/zegunotu.pdfIn PDF document text
    • http://bojemef.com/uploads/1/3/0/7/130776519/bbded04bdae75.pdfIn PDF document text
    • http://bigbonedfitness.com/uploads/1/3/0/8/130814803/583330.pdfIn PDF document text
    • http://translantau.transasiaseries.com/uploads/1/3/0/3/130313122/gabanobakiwodowatape.pdfIn PDF document text
    • http://palmsecurityservices.com/uploads/1/3/0/5/130590535/dodesi-detodu-wedokabejiwibo.pdfIn PDF document text
    • http://natashiapandther.com/uploads/1/3/0/5/130589277/1663192.pdfIn PDF document text
    • http://callingourselveshome.weebly.com/uploads/1/3/0/6/130604667/3bd56.pdfIn PDF document text
    • http://ne-surgerycenter.net/uploads/1/3/0/2/130272524/130272524.html#word+to+pdf+small+pdf+converterIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000142d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x142D 12292 bytes
SHA-256: 7a83752c4abd8919505e48a22fbc7ece89c2a4dceee500136a45bc98a895d9d9

Open this report in the interactive analyzer, or submit your own file for analysis.