Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cd5af53efc333f1…

MALICIOUS

PDF

54.1 KB Authoring application: Scribus
MD5: d396e96aad222cd2a4317bd74c986117 SHA-1: 22a11827b4eb3c87efc80e5a6f2374654feae307 SHA-256: 8cd5af53efc333f1a19aa9e40c2385286b3577978ed1e9ca49157cd782cd5d07
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV identifying it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The critical PDF_SEO_LINK_FARM heuristic indicates a mass of external links, with the first being http://lloydstreeter.com/uploads/1/3/0/6/130603741/78383dc4781.pdf. This suggests the document's primary purpose is to lure users to malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lloydstreeter.com/uploads/1/3/0/6/130603741/78383dc4781.pdf
    • http://msmohp.org/uploads/1/3/0/5/130588702/1493412.pdf
    • http://teslabeamedpower.com/uploads/1/3/0/7/130738955/voletepukuxag.pdf
    • http://aim-mississauga.org/uploads/1/3/0/4/130476574/porugo.pdf
    • http://mentorpreschools.com/uploads/1/3/0/6/130621208/394836dbd7bb7.pdf
    • http://minnickmanagementhoa.com/uploads/1/3/0/5/130539204/dalogota.pdf
    • http://mgwzjyxlmdhyngledvj.weebly.com/uploads/1/3/0/6/130603878/nomosinorujosuziwij.pdf
    • https://xukagidisazeve.weebly.com/uploads/1/3/0/5/130550789/semovox.pdf
    • http://sweetestdreams.org/uploads/1/3/0/6/130604988/130604988.html#yasin+s%C3%BCresinin+t%C3%BCrk%C3%A7e+ve+arap%C3%A7a+okunu%C5%9Fu

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001492.bin
fddb7ab3ae1348ac0f565cddc2c7db9f018890da7c09d0bddeaf788b2975cad8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1492 10320 bytes
font_01_sfnt_off00008c6d.bin
0b3135045e34032c8de1addd4ae8caea56d4bc16bf8744dca55fcb615fb788f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C6D 16424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.