Malicious PDF — malware analysis report

Static analysis result for SHA-256 aaf573aae710f4ae…

MALICIOUS

PDF

41.5 KB Authoring application: Scribus
MD5: c7e0472c6d833447b20dc8ec6ca7ba31 SHA-1: 9aac086350a4126c5bede95ae36875bc4dd9a254 SHA-256: aaf573aae710f4ae8356e2df14431f0ee94eee619b8bec993fc1267b23f1ebe2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm or redirection mechanism. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://appleplayschools.net/uploads/1/3/0/6/130604667/1272068.pdf
    • http://www.trikli.com/uploads/1/3/0/6/130621031/lefumukexosop_nomawoterir_kunakev_vamediwusiwasi.pdf
    • http://trafficlynx.com/uploads/1/3/0/5/130539042/janujosunupusiwa.pdf
    • http://musicinthe.club/uploads/1/3/0/7/130774978/e8401d.pdf
    • http://sonrisasparadios.org/uploads/1/3/0/7/130775504/36e6d66e55.pdf
    • http://yourcreativearmy.com/uploads/1/3/0/6/130639251/3985166f6290f.pdf
    • http://geoffcodeswebsite.com/uploads/1/3/0/4/130436204/5594492.pdf
    • http://host50.pama.org/uploads/1/3/0/8/130813798/rumexug.pdf
    • http://patriciabondrn.com/uploads/1/3/0/2/130289563/pozapuxifetaziw.pdf
    • http://lebaraparfum.net/uploads/1/3/0/7/130775658/jerisevejexa_vagez.pdf
    • http://freecourts.com/uploads/1/3/0/6/130639514/6040790.pdf
    • http://tobegenz.com/uploads/1/3/0/8/130813765/61d84393f.pdf
    • http://mormon-clothes.com/uploads/1/3/0/4/130488736/9718163.pdf
    • http://bigandsmallkindtoall.com/uploads/1/3/0/2/130289630/9914878.pdf
    • http://missprisstea.com/uploads/1/3/0/7/130776492/3271740.pdf
    • http://wakerwood.com/uploads/1/3/0/3/130324170/joxiza-gefuwi-dajixix.pdf
    • http://scopehomeinspection.com/uploads/1/3/0/6/130621646/9a996b3e342963.pdf
    • http://josephanspach.com/uploads/1/3/0/3/130323374/susuvomog.pdf
    • http://wildxrace.com/uploads/1/3/0/4/130476403/naziwim.pdf
    • http://agapemedped.com/uploads/1/3/0/7/130775622/tovufaperu-xezerusutone-nuzutuwaxiwura-nitufuzodiwap.pdf
    • http://www.parakhin.name/uploads/1/3/0/6/130603994/fe393.pdf
    • http://mickaelpalma.com/uploads/1/3/0/6/130605111/jibixexapubower_mazoromubotawu_tixafune.pdf
    • http://musicmegapack.com/uploads/1/3/0/2/130270989/5e5054a37.pdf
    • http://www.indigostaging.com/uploads/1/3/0/5/130589042/vamepat-kaveda.pdf
    • http://joriphillips.com/uploads/1/3/0/3/130312923/6461340.pdf
    • http://wcd-ggtd2i7.mgh-r.ch/uploads/1/3/0/5/130540714/130540714.html#power+air+fryer+xl+recipes+wings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ebf.bin
9153ebd57cd7b1c3526afab79411d4e625d6f633a3840722a870007625d86265		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3EBF 7712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.