Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d4d72688a386506…

MALICIOUS

PDF

35.7 KB Authoring application: Scribus
MD5: 813540e949928535f0e53122e5ea83bf SHA-1: 067a03ef3d0f5b223e69687374f203ae2156b807 SHA-256: 6d4d72688a386506c2d133b5ebf78fbdde74191bc5ff675c775ad68ee917e8da
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a common technique for SEO poisoning or distributing malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic redirection scheme. The document body references popular video games, likely as a lure to entice users to click on the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stcolumbanusalumni.org/uploads/1/3/0/6/130604310/juromenaf-mizugef-dugis.pdf
    • http://parkland.school.nz/uploads/1/3/0/6/130603892/7125580.pdf
    • http://josettesphotography.com/uploads/1/3/0/6/130604678/7344126.pdf
    • http://precisiongroupllc.net/uploads/1/3/0/9/130969130/1436178.pdf
    • http://www.feng-qiu.com/uploads/1/3/0/4/130483833/kinadogileso_duwukosi_gukozufugawek.pdf
    • http://sassyfrassy.com/uploads/1/3/0/4/130488063/kikozuzanenu-luzajaf.pdf
    • http://charlestongospelchoir.com/uploads/1/3/0/6/130621938/44ee65d.pdf
    • http://73ipathy.com/uploads/1/3/0/8/130814172/3bc3937b91.pdf
    • http://kingextermination.com/uploads/1/3/0/2/130292148/6110314.pdf
    • http://thestorefrontgallery.com/uploads/1/3/0/4/130477110/5296692.pdf
    • http://algaebookandpaper.com/uploads/1/3/0/7/130776641/2231976.pdf
    • http://lovinglifewithabundance.com/uploads/1/3/0/9/130969430/nuvaxodega.pdf
    • http://nayaessentials.com/uploads/1/3/0/8/130874385/b755e4ffbef.pdf
    • http://she169.brdge.org/uploads/1/3/0/6/130605077/130605077.html#gta+vice+city+cheats+pc+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000328b.bin
e21decb4132025bdd021874edce54e9e85960a91c0b5765ecf705010be760f60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x328B 7940 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.