Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b06dc0a5e97b0cd…

MALICIOUS

PDF

34.6 KB Authoring application: Scribus
MD5: d3ce418d2b5d555f3c009312001d7b72 SHA-1: 9a3e4cd6835c8e7d126e70cb270af9b07c83341f SHA-256: 7b06dc0a5e97b0cd4e1afc5d515e2b6527a70b9d5377572140e36dc0ad2a3161
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics, including ClamAV and an ML classifier, for malicious content. The PDF_SEO_LINK_FARM heuristic identified a large number of embedded external links, with the first being http://sensaur.com/uploads/1/3/0/2/130287866/6ad91a290c5628.pdf. This suggests the document's primary purpose is to redirect users to a network of potentially malicious websites, consistent with phishing or SEO spam campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sensaur.com/uploads/1/3/0/2/130287866/6ad91a290c5628.pdf
    • http://metoomvntinfo.com/uploads/1/3/0/4/130436068/5694607.pdf
    • http://dlhp-solutions.com/uploads/1/3/0/6/130605358/14203a5.pdf
    • http://www.theartofagriculture.org/uploads/1/3/0/6/130620906/dapipatoduwe-letajepibedibu-muworutolepid.pdf
    • http://ns1.meadowsparkapts.com/uploads/1/3/0/2/130288639/6309956.pdf
    • http://victoriagroupllc.net/uploads/1/3/0/2/130288644/zukaribosuvuziw.pdf
    • http://constitutioninsurance.com/uploads/1/3/0/2/130288710/dafus.pdf
    • http://www.downstagecenter.org/uploads/1/3/0/5/130588728/jupiwexapofixurorel.pdf
    • http://whenjusticeisntjust.com/uploads/1/3/0/6/130620679/vavulelixup.pdf
    • http://andrewtimmer.com.au/uploads/1/3/0/6/130621393/7468617.pdf
    • http://www.morethansoulfood.net/uploads/1/3/0/7/130739781/130739781.html#attach+multiple+pdf+files+into+one
    • http://whenjusticeisntjust.com/uploads/1/3/0/6/130620679/vavulelixu

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003140.bin
05c769304dfb6ca3aa50c42a1b87873b3018cc6784b891364169c742e6cbabbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3140 7792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.