Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b1b7c6acbb97744…

MALICIOUS

PDF

37.3 KB Authoring application: Scribus
MD5: 3ca332865f8a8441d215e8305ede090d SHA-1: 277973fca53d14ca9897acd7dc2a2a6381e82bdc SHA-256: 7b1b7c6acbb97744448d655207d5adeb6578ef8c6c07eec4e7fd7214d86cb0e4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links, such as http://mybrokersells.net/uploads/1/3/0/7/130740231/5275767.pdf, are likely intended to lure users to malicious websites. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and redirection intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mybrokersells.net/uploads/1/3/0/7/130740231/5275767.pdf
    • http://verticalfitness100.com/uploads/1/3/0/2/130272443/7767268.pdf
    • http://hotelpetfranchising.com/uploads/1/3/0/7/130738946/sujijikiripole.pdf
    • http://barriebasketball.com/uploads/1/3/0/5/130589430/gikekemetuxudipojar.pdf
    • http://athywaterways.com/uploads/1/3/0/8/130814004/459988.pdf
    • http://roundrockeventplanners.com/uploads/1/3/0/3/130313564/bibaj.pdf
    • http://stacheyourcat.com/uploads/1/3/0/4/130435715/rasewijiti-dezepujala-napavususuxa-tariwo.pdf
    • http://myonebighappyphotography.com/uploads/1/3/0/7/130739956/mubojenefat-xowukalovala-vakinupoxovi.pdf
    • http://hasbropowerrangers.com/uploads/1/3/0/3/130324203/fcb2dd9.pdf
    • http://weblacarte.com/uploads/1/3/0/3/130323789/c2e9c5c.pdf
    • http://newcovenantinspections.com/uploads/1/3/0/6/130639217/nexefororu-rukekumoxatezuk-podena-kegexafilajab.pdf
    • http://aliveatfive.org/uploads/1/3/0/6/130639883/dexekewafava.pdf
    • http://fancyfeatheredfarm.com/uploads/1/3/0/6/130639197/db5e97891c9836d.pdf
    • http://mx.adornkids.com/uploads/1/3/0/6/130640024/26d0f.pdf
    • http://bobbodagreen.com/uploads/1/3/0/8/130814341/xowojukutipisurukiva.pdf
    • http://osvaldogiuliani.com/uploads/1/3/0/6/130603994/guluxelow-xagexerinuz-xidejawexuse.pdf
    • http://buzzfanzine.com/uploads/1/3/0/7/130776590/2374179.pdf
    • http://artbygirls.com/uploads/1/3/0/5/130544703/9804764.pdf
    • http://thefourfuries.com/uploads/1/3/0/5/130543168/tidojipazekopuxunulu.pdf
    • http://nxlevelgolf.com/uploads/1/3/0/7/130739529/ronovibajapanijefel.pdf
    • http://x0065289xstreamtravel.xsideas.com/uploads/1/3/0/6/130639157/130639157.html#additional+protocol+i+to+the+geneva+conventions+of+1949

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031d8.bin
73ccf419df734562283e1c70241b68351406212676c941f70164077bf920c3b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31D8 7892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.