Malicious PDF — malware analysis report

Static analysis result for SHA-256 97f64a504847286d…

MALICIOUS

PDF

38.5 KB Authoring application: Scribus
MD5: 9ff36446b3ce31e3db7cd80b70cfbb36 SHA-1: 581a39973501270a057811be84c0306617466b30 SHA-256: 97f64a504847286d1b4d519f136f0e4b49c1a8c2adbe67f02e208b2c4eb23a78
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for malicious content, as suggested by the 'PDF_SEO_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS' heuristics. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bigcreekgreenway.org/uploads/1/3/0/5/130540197/e29d3a08dd0c300.pdf
    • http://keithmannen.net/uploads/1/3/0/7/130738889/3184883.pdf
    • http://www.pittmanenterprises.org/uploads/1/3/0/7/130776741/2557e6435c69d.pdf
    • http://calciomaestro.com/uploads/1/3/0/5/130539497/4821c1874.pdf
    • http://www.vidasocialmagazine.com/uploads/1/3/0/5/130544009/rufomumaxamumama.pdf
    • http://stephenshooster.com/uploads/1/3/0/2/130288399/gaxek-kusemavimu-zetaxeputufisi.pdf
    • http://mail.tuscanpta.org/uploads/1/3/0/3/130323588/9964467.pdf
    • http://passionatepursuit.net/uploads/1/3/0/7/130776008/golinisonowakewuze.pdf
    • http://activeachievers.com/uploads/1/3/0/4/130435835/5063860.pdf
    • http://mta-sts.mail.mannersinmomentum.com/uploads/1/3/0/7/130740298/duluparunazes.pdf
    • http://earltomblin.com/uploads/1/3/0/4/130476320/jupajajobajax_surotuwofisotub_tujonubigix.pdf
    • http://virginiabeachfishing.org/uploads/1/3/0/7/130739502/411921.pdf
    • http://randomchorus.com/uploads/1/3/0/5/130551014/9596487.pdf
    • http://redoak-tech.com/uploads/1/3/0/4/130483810/mipuguweponaj.pdf
    • http://drzhuweimin.com/uploads/1/3/0/2/130271001/3674078.pdf
    • http://mojavebows.com/uploads/1/3/0/6/130621965/juzazewoninadu.pdf
    • http://threadsofthewayfarer.com/uploads/1/3/0/7/130775383/sosetepuku_viguxadaw_bodubofulog_fekufim.pdf
    • http://kidsphilharmonic.com/uploads/1/3/0/7/130775092/kolil_moxoz_gesaz_xelatumixesuw.pdf
    • http://3rddegreeburnsbbq.com/uploads/1/3/0/2/130272278/130272278.html#defining+and+non+defining+relative+clauses+powerpoint
    • http://earltomblin.com/uploads/1/3/0/4/130476320/jupajajobajax_surotuwof

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003636.bin
9725e565210beabccf6881b1b84c3e31104b43f99bc0c0ab7e99a0edc44498c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3636 8700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.