Malicious PDF — malware analysis report

Static analysis result for SHA-256 80d3a50cd0c8f893…

MALICIOUS

PDF

36.2 KB Authoring application: Scribus First seen: 2020-09-24
MD5: 984de4a0cce020b07e2e67f5bfb53c21 SHA-1: 63c633589d41c52f7bc977b600ead4c9ac1d4a2b SHA-256: 80d3a50cd0c8f89321b0e4a697bd38f65254231979f4c55c7c0e1ba2897e875a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly indicate maliciousness, specifically related to phishing. The embedded URLs likely lead to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://razer.18xx.fun/uploads/2020/01/28/zunuwivovitegib.pdf In PDF document text
    • http://alanpliuart.com/uploads/1/3/0/5/130590511/5971629.pdfIn PDF document text
    • http://mygoodlife.solutions/uploads/1/3/0/5/130551795/relopelem.pdfIn PDF document text
    • http://lefetus.massrage.ru/uploads/2020/01/27/dewukumofukavefula.pdfIn PDF document text
    • http://kef.markaajans.online/uploads/2020/01/28/menosanavuziduv_liluvemibunutud_nupokufolumev.pdfIn PDF document text
    • http://xibulujij.vipiski-besplatno29.icu/uploads/2020/01/28/0918ff702.pdfIn PDF document text
    • http://ceecentre.com/uploads/1/3/0/6/130620337/ridelenado.pdfIn PDF document text
    • http://bdaddysgrill.net/uploads/1/3/0/5/130589237/5657165.pdfIn PDF document text
    • http://conversionpix.com/uploads/1/3/0/4/130476034/demolokunarop.pdfIn PDF document text
    • http://vomopig.stopgemorroj.ru/uploads/2020/01/28/siwotej.pdfIn PDF document text
    • http://matthewschwartz.org/uploads/1/3/0/6/130621839/4368196.pdfIn PDF document text
    • http://bsa-sccc-pack301.com/uploads/1/3/0/5/130590672/130590672.html#99+lexus+gs300+throttle+position+sensorIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C3 8412 bytes
SHA-256: 66185b1bb850129754bf8c2dba8adaa8131859274f905b4f8a2877a7e1c6976f

Open this report in the interactive analyzer, or submit your own file for analysis.