Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d81049b477a967f…

MALICIOUS

PDF

42.9 KB Authoring application: Scribus
MD5: c55a1f6ec5cced2f146b589343cf9c18 SHA-1: fc38e26ed9cd6c28250ef475f1025008b55beb89 SHA-256: 6d81049b477a967fde63305e4051acab29b4cd50a6df73dbf48b04d965a9bbb5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, with ClamAV identifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document body, though heavily obfuscated, contains several URLs that are also listed in the extracted URLs, suggesting a coordinated effort to redirect users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mmflackdesigns.com/uploads/1/3/0/6/130621574/4a5f92f3a48.pdf
    • http://adayofhope.co/uploads/1/3/0/5/130551266/vuvofad_jetajojowuvaxop.pdf
    • http://bigdipbirding.com/uploads/1/3/0/6/130603835/af344.pdf
    • http://mirrormath.net/uploads/1/3/0/6/130605111/5322687.pdf
    • http://powerbabes.net/uploads/1/3/0/6/130604518/23debc.pdf
    • http://molleo.in/uploads/2020/01/28/e85038d36.pdf
    • http://crimsonshadowpack.com/uploads/1/3/0/4/130490019/788e60.pdf
    • http://merrillsoccer.org/uploads/1/3/0/7/130738972/130738972.html#poner+un+dedo+encima+significado+de

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001189.bin
0a0e14402ca1cbc39a4f1a33858f616ce378ec9205210a22e7fd5bf9e6a7285b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1189 9356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.