Malicious PDF — malware analysis report

Static analysis result for SHA-256 a67d4de58740672d…

MALICIOUS

PDF

60.5 KB Authoring application: Scribus
MD5: cd683a80a55784e5f6571b97cbc7efd2 SHA-1: f5f1cb2bce9c86bf9287f80c7233c5bcd52e1fac SHA-256: a67d4de58740672dbabe6f6a93ad0558e71e941e6c7f46c1f4de3fcd6d882399
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple heuristics, including ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a critical finding for a PDF link farm. The document body contains numerous URLs pointing to other PDF files, suggesting a distribution mechanism for phishing or malware. The primary attack pattern involves luring users to click on these links, which likely lead to malicious payloads or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://missioncovenantyouth.org/uploads/1/3/0/4/130476493/4722524.pdf
    • http://shawinsurancerealty.com/uploads/1/3/0/2/130292098/3d7514fcbb0.pdf
    • http://fishionista.com/uploads/1/3/0/5/130540767/gosijumalurobilegek.pdf
    • http://pem.trysiki.ru/uploads/2020/01/27/jugoligolam_mumup.pdf
    • http://carprodip.com/uploads/1/3/0/5/130538956/4110474.pdf
    • http://formationalurimmobilier.com/uploads/1/3/0/5/130589209/aa06644f445.pdf
    • http://monistaris.com/uploads/2020/01/28/bosodolerofamiwotem.pdf
    • http://afhe.org.au/uploads/1/3/0/6/130621654/3171.pdf
    • http://kak-chto.ru/uploads/2020/01/27/9816597.pdf
    • http://sosugag.dexterius.com/uploads/2020/01/28/kijobeku_nuzarumobukek.pdf
    • http://mitchheaslipfitness.com/uploads/1/3/0/3/130312913/af101a1f23.pdf
    • http://foxif.ecorutas2x2.com/uploads/2020/01/29/dca094df.pdf
    • https://fisuguno.weebly.com/uploads/1/3/0/5/130551206/2356995.pdf
    • http://cyclebavaria.com/uploads/1/3/0/2/130272932/pukewidagowuv.pdf
    • http://woodlandstuition.com/uploads/1/3/0/6/130621334/130621334.html#nios+deled+result+1st+semester+2018+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001545.bin
fc007c3fbff20fecb75777fc22f8428b753043191b94d4dca7b2f07c9c9831ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1545 8352 bytes
font_01_sfnt_off00009094.bin
f9343b8fcfaa9b8e39400133d4d30a2abe516a8ae76bda73a928203882236564		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9094 16864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.