Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e286f33622fa53d…

MALICIOUS

PDF

40.7 KB Authoring application: Scribus First seen: 2020-09-24
MD5: d67e088db7194fed79bf11915d4dfb9f SHA-1: 30d48d801e5791992ade498d79c0783bf50a31fa SHA-256: 6e286f33622fa53d76a48a674429a7dbe7ccbc6d16e1f654201261fe766a00f5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical rule for a mass external PDF link farm and a ClamAV detection for phishing. The document body is heavily obfuscated, but the embedded URLs and the PDF_SEO_LINK_FARM heuristic indicate a likely attempt to manipulate search engine results or distribute malicious content via numerous external PDF links. The presence of many unknown-reputation URLs suggests a campaign to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://laudes.org/uploads/1/3/0/4/130476516/nilanegobokadevimu.pdf In PDF document text
    • http://zhonghuayulechengdubowangzhan.f18.ebkf.org/uploads/1/3/0/5/130539373/zovoliwokum_vesomedodog_fagaga.pdfIn PDF document text
    • http://adentaitalia.com/uploads/1/3/0/3/130379341/somabofaxolabo-gurobi-gesatunol-doxanelepijira.pdfIn PDF document text
    • http://bbmae.com/uploads/1/3/0/2/130291371/wiwirakapezup-tuzulag-gatetib.pdfIn PDF document text
    • http://5calls.com.au/uploads/1/3/0/7/130739253/gujelimum-kibulosawozuwil-pesuf.pdfIn PDF document text
    • http://beckmannmediagroup.com/uploads/1/3/0/7/130739573/fulun.pdfIn PDF document text
    • http://ketoboxie.com/uploads/1/3/0/2/130289797/9852269.pdfIn PDF document text
    • http://farmerbillsorganicgardens.com/uploads/1/3/0/6/130605153/zudav.pdfIn PDF document text
    • http://nowbiz.net/uploads/1/3/0/7/130776741/mibisezutuzibawosa.pdfIn PDF document text
    • http://helpstagemyhouse.com/uploads/1/3/0/7/130776617/8570884.pdfIn PDF document text
    • http://fitrighthome.com/uploads/1/3/0/5/130551008/bepatona-vozovu.pdfIn PDF document text
    • http://noradragoon.com/uploads/1/3/0/6/130622009/gesiviwobebebi.pdfIn PDF document text
    • http://bowencreativelabs.org/uploads/1/3/0/3/130380084/9056549.pdfIn PDF document text
    • http://lettiemars.com/uploads/1/3/0/8/130874222/zapadixowegupo_pukuv_wedinemegobe_ronariluvofivi.pdfIn PDF document text
    • http://cookedwithhart.com/uploads/1/3/0/5/130551794/nawuxok.pdfIn PDF document text
    • http://soque.net/uploads/1/3/0/6/130621132/9384920.pdfIn PDF document text
    • http://www.betterlivingtransport.com/uploads/1/3/0/9/130969366/3132375.pdfIn PDF document text
    • http://timmaninstallatie.nl/uploads/1/3/0/3/130379246/8843939.pdfIn PDF document text
    • http://orockrotorua.co.nz/uploads/1/3/0/7/130775173/voxapoxomevifijom.pdfIn PDF document text
    • http://free-vibes.com/uploads/1/3/0/8/130814007/pugajalupuseno.pdfIn PDF document text
    • http://katiegbryant.com/uploads/1/3/0/5/130551611/b4a89.pdfIn PDF document text
    • http://livtrak.com/uploads/1/3/0/5/130550682/d9887137f2d74e.pdfIn PDF document text
    • http://wangshangqipaiyouxizhuanqian.br3h.com/uploads/1/3/0/4/130491699/130491699.html#english+to+chinese+medical+dictionary+with+pinyin+pdfIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
🗂 Part of campaign: ketoboxie.com 6 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002065.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2065 8768 bytes
SHA-256: 88bfb75b47fb138b6f61cabc56bbedecc79fcb7c35658b73dc2e91828e0934b4
font_01_sfnt_off00003e72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E72 7480 bytes
SHA-256: 5071a36c410dfb3074ba309801be9344c098aef2a30a6d87ddb80dbc0354c4aa

Open this report in the interactive analyzer, or submit your own file for analysis.