Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c8eb889d7c86cd2…

MALICIOUS

PDF

40.4 KB Authoring application: Scribus
MD5: 41d91138fb61010470852f871263862b SHA-1: 633bb30d7812457898db1a5063fea1b46e68a2fe SHA-256: 9c8eb889d7c86cd24805785be40ccca82ecb27acd6f4f54a9b08e1bbdaa021d6
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection tactic. The SE_INVOICE_LURE heuristic indicates a potential phishing or scam pretext. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wifeycosmetics.com/uploads/1/3/0/5/130590191/5242061.pdf
    • http://albeson.com/uploads/1/3/0/6/130604031/fopajorukumed.pdf
    • http://melfelk.com/uploads/1/3/0/7/130775087/jezawexoluwuzif.pdf
    • http://dakotaashleymarie.com/uploads/1/3/0/5/130550682/lubemirufeburapabu.pdf
    • http://cupcakes.delivery/uploads/1/3/0/3/130379445/wovurojuxitak-mowojaxenevim-gudazirebedi.pdf
    • http://www.mtview-ak.com/uploads/1/3/0/7/130775366/fagutotixuxigu-vodulumozez-migakox-xakafuluguzul.pdf
    • http://discountclosetspecialist.com/uploads/1/3/0/5/130588605/cfa2af0.pdf
    • http://djlion.me/uploads/1/3/0/7/130739601/zibafekazijal_jorazutuk_ruvonizisalak_zegakijax.pdf
    • http://greerwaterworks.com/uploads/1/3/0/4/130476144/wivelimazugafovi.pdf
    • http://nchep2017.org/uploads/1/3/0/4/130483805/f77a9a.pdf
    • http://www.rockyviewstudios.com/uploads/1/3/0/4/130483067/7059582.pdf
    • http://ryanodaypresents.com/uploads/1/3/0/2/130289669/fafadazofo-xesuwan.pdf
    • http://cheaptokeeptreesandlandscapes.org/uploads/1/3/0/4/130489132/kiritenoner.pdf
    • http://mydivineinspirations7.store/uploads/1/3/0/6/130621243/3553774.pdf
    • http://dream-job.site/uploads/1/3/0/4/130492315/892c902.pdf
    • http://www.informationsystemdynamics.net/uploads/1/3/0/5/130543006/musofaratelol.pdf
    • http://jeanniehouchins.com/uploads/1/3/0/3/130323374/8600034.pdf
    • http://uibffworld.org/uploads/1/3/0/5/130551675/130551675.html#allianz+global+assistance+travel+insurance+policy+wording
    • http://discountclosetspecialist.com/uploads/1/3/0/5/1305886

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003df0.bin
5e35ea7cfe1ee6d49b5b946f3ffce0fde1c1675552197fa665ea6bb401a0405b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3DF0 9140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.