Malicious PDF — malware analysis report

Static analysis result for SHA-256 afe23e50dc1c6ceb…

MALICIOUS

PDF

37.7 KB Authoring application: Scribus
MD5: cb51dbe61bdbf32eb80e06465355bf8d SHA-1: bc3311e434a9d2e6a48b0835ebe0b4f5df8b887c SHA-256: afe23e50dc1c6ceb051ad795820b943c1c4af964a12f68088a9d4e53ff88dda3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was identified as malicious by ClamAV and an ML classifier, and it contains a large number of external links. The heuristic PDF_SEO_LINK_FARM indicates a link farm, suggesting the document's primary purpose is to host numerous external links, likely for SEO manipulation or to redirect users to malicious content. The embedded URL 'http://skolhandledning.se/uploads/1/3/0/3/130379523/5976640.pdf' is part of this link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://skolhandledning.se/uploads/1/3/0/3/130379523/5976640.pdf
    • http://minahostage.com/uploads/1/3/0/2/130272377/4422529.pdf
    • http://guru-inside.com/uploads/1/3/0/4/130488228/gerejuputepetubafuz.pdf
    • http://3dactivesports.com/uploads/1/3/0/7/130739449/wujar_ziwudipofasede_sokusopiwep_xogode.pdf
    • http://ivonnelagunez.com/uploads/1/3/0/6/130639863/wimirodibotu-ridalasip.pdf
    • http://dmnroundtable2020.com/uploads/1/3/0/5/130545185/02155d6d131.pdf
    • http://graniteconsultingnh.com/uploads/1/3/0/6/130604644/0a9ff176245e0.pdf
    • http://www.gentlemensphoto.com/uploads/1/3/0/8/130874674/muguxagomalus.pdf
    • http://keeganwhitedesigns.club/uploads/1/3/0/6/130621160/347496.pdf
    • http://www.eroticretreats.com/uploads/1/3/0/7/130739121/polugozume_pofepifovebuw_vubifipatula_vakezirifi.pdf
    • http://www.witneycollectables.com/uploads/1/3/0/5/130539350/jisisarojufiz.pdf
    • http://myresortwear.net/uploads/1/3/0/6/130620635/gajivufesilemek.pdf
    • http://refugeespeaker.org/uploads/1/3/0/2/130289338/saritogojobog.pdf
    • http://nikitakingphotography.com/uploads/1/3/0/6/130639468/581815c.pdf
    • http://ministryiq.net/uploads/1/3/0/5/130589385/39006f2.pdf
    • http://phaemacmin.com/uploads/1/3/0/4/130476122/fanonolilu.pdf
    • http://mithranm.com/uploads/1/3/0/5/130588237/mediwezojeb.pdf
    • http://kuniusedcars.com/uploads/1/3/0/7/130739780/857415.pdf
    • http://advancedbiocomputing.org/uploads/1/3/0/8/130873786/ruvotad.pdf
    • http://45oakridgelane.com/uploads/1/3/0/6/130639840/5156325.pdf
    • http://mr-castironcreations.com/uploads/1/3/0/5/130588430/d060bc4aac6e55.pdf
    • http://toqueteo.com/uploads/1/3/0/2/130289218/tupejoxuzisof-koverulanav.pdf
    • http://bhpromove.com/uploads/1/3/0/3/130323178/bb313.pdf
    • http://myexplorelive.com/uploads/1/3/0/4/130489020/d5d5e95b5.pdf
    • http://lotusenterprisescr.com/uploads/1/3/0/7/130738753/a32462693.pdf
    • http://74-123-77-56.mgwnet.com/uploads/1/3/0/5/130542977/130542977.html#algebraic+equations+test+pdf
    • http://nikitakingphotography.co

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e9a.bin
2a2bde120e8b5bfb35126c2d74e5661225f0828909bf9a0593a23d7dcf749689		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E9A 7996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.