Malicious PDF — malware analysis report

Static analysis result for SHA-256 8800d5b4b0d878c6…

MALICIOUS

PDF

40.8 KB Authoring application: Scribus
MD5: 99fd7b047b34aec433e4dd7eb017b766 SHA-1: 8bb00326afbb8323cac31d9f5ea6881d871b1580 SHA-256: 8800d5b4b0d878c6a660ae80ccbfb260bd1505631036781831a2468c76705ca2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which are likely intended to direct users to malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically related to phishing. The document body, though partially corrupted, references sheet music and includes URLs that are part of a link farm, suggesting a lure to download further malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://worasapam.weebly.com/uploads/1/3/0/5/130541023/5a9130.pdf
    • http://alkotoxx.ru/uploads/2020/01/29/tirozuxi_pibeluvudomedi_ketel_romitejumopobe.pdf
    • http://arlingtoneaglesvb.weebly.com/uploads/1/3/0/4/130476736/suzaxorajep-vunixavadesu.pdf
    • https://manupezali.weebly.com/uploads/1/3/0/3/130313173/fafegegawirus.pdf
    • http://999fmradiomanila.com/uploads/1/3/0/5/130539300/77ce49d6eef6354.pdf
    • http://pavanmehat.com/uploads/1/3/0/6/130604658/b32715399ab692.pdf
    • http://skinbeautybymaggie.com/uploads/1/3/0/3/130313177/zivumurerexi-bimekekuja-zikiniza-jipat.pdf
    • http://advance-it.net/uploads/1/3/0/4/130476034/130476034.html#brandenburg+concerto+5+violin+sheet+music
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004e3b.bin
da608677239f2f8593ea0ea75f4fd115c259b28ddfe03fc2c9d4fc369afd09ba		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E3B 19900 bytes
font_00_sfnt_off000011fa.bin
fd57779e78b98b4fbed1cf59754ad2a37c24861bd0eb31309bcbde8bba1c8cff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FA 8456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.