Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2f4243ab3dbb2cc…

MALICIOUS

PDF

38.6 KB Authoring application: Scribus
MD5: 53ef4c67271a6d60aef4bedfc9cd283f SHA-1: e0a5c0a03f6b228ae3f65a1a2d0beec2ba6a130b SHA-256: a2f4243ab3dbb2ccd3a5c87101c852d5278fc056af8cb41b548a72e462a72938
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which is indicative of a link farm or traffic redirection scheme. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or driving traffic to malicious content. The document body text, though heavily obfuscated, appears to be a lure related to educational materials.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ebc3.org/uploads/1/3/0/6/130620313/9221232.pdf
    • http://central24h.com/uploads/1/3/0/7/130740389/48584c3a4.pdf
    • http://scricco.org/uploads/1/3/0/6/130639230/8952376.pdf
    • http://boiserealestatejournal.com/uploads/1/3/0/7/130776325/nagemalixa.pdf
    • http://pinestschool.com/uploads/1/3/0/3/130313140/dubixabuju-laboduvaguti.pdf
    • http://cabinetdanconsulting.com/uploads/1/3/0/5/130539338/918754.pdf
    • http://jolyongray.net/uploads/1/3/0/6/130639786/gufatitegulimaw-lenavevikazaret-lotobipizugom-namewadov.pdf
    • http://christinescott.info/uploads/1/3/0/7/130776388/8674047.pdf
    • http://gocollegeprep.com/uploads/1/3/0/8/130873894/bikufarivenupibuti.pdf
    • http://shopofficeglam.com/uploads/1/3/0/3/130379743/dixev.pdf
    • http://standrewlutheranportsmouthva.com/uploads/1/3/0/5/130551457/barajosawaf.pdf
    • http://starksatellite.com/uploads/1/3/0/3/130323738/vuviwemu-romajaxove-tonofeg-dubarixikusate.pdf
    • http://74-123-77-252.mgwnet.com/uploads/1/3/0/3/130313004/130313004.html#abecedario+para+imprimir+con+los+4+tipos+de+letras
    • http://boiserealestatejournal.com/uploads/1/3

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003cf8.bin
a33c64904ef1e564efa82c582f44352503657a3a808ede7961f59f275e103941		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CF8 9144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.