Malicious PDF — malware analysis report

Static analysis result for SHA-256 869210763e0d719e…

MALICIOUS

PDF

39.8 KB Authoring application: Scribus
MD5: 6e892ef7d6fc45325eb8eaa72b4aa409 SHA-1: 3e58bd5929aea5163bac6b01ce6716072899ed9a SHA-256: 869210763e0d719ef3a09ced190cce60056424fdb0942f9048bf3de33e3fd7b8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection also flags this as Pdf.Phishing.TtraffRobotInstall. This suggests the document is designed to redirect users to a multitude of other PDF files hosted on various domains. The purpose is likely to manipulate search engine results or distribute further malicious content through these linked PDFs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ghz.one/uploads/1/3/0/5/130588343/geritokazezive-zozogunakakopi.pdf
    • http://trixiekitty.com/uploads/1/3/0/3/130379411/dulemewa.pdf
    • http://culturallyresponsivesustainedteaching.com/uploads/1/3/0/3/130379231/d5e9ddd0ad413.pdf
    • http://rosshousemuseum.ca/uploads/1/3/0/5/130588357/6fa364a0.pdf
    • http://mysteretro.com/uploads/1/3/0/6/130603753/kajoxisuw-melapinebag-gokabo-sebinadifu.pdf
    • http://animalmatters.com.au/uploads/1/3/0/5/130539227/9685939.pdf
    • http://gametimeranch.com/uploads/1/3/0/4/130436078/jejenatorojilubowaxe.pdf
    • http://northwestembroidery.net/uploads/1/3/0/5/130550914/9404397.pdf
    • http://realfoodinitiatives.com/uploads/1/3/0/3/130313093/8f80cf329fae.pdf
    • http://rockpraxis.com/uploads/1/3/0/6/130621719/1093477.pdf
    • http://nonetitle.com/uploads/1/3/0/5/130543262/2616505.pdf
    • http://desatascosbadalona.net/uploads/1/3/0/5/130551089/bd3bae97b.pdf
    • http://67xq3.salon225.com/uploads/1/3/0/6/130603874/130603874.html#activated+charcoal+for+drinking+water+filter
    • http://animalmatters.com.au/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004242.bin
76fd16a8d831f57a9ac9540f9f8b3493ecbb8dfac371ebf4cf65885e707d33a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4242 8536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.