Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7be666d176e9c60…

MALICIOUS

PDF

38.2 KB Authoring application: Scribus
MD5: 290ec2e130e541ea5cac6b1358f00885 SHA-1: c3bf648752238966aec377eacacc62e3985c1d1f SHA-256: b7be666d176e9c60bdc4f037193fb1c903719d2925a69eb16efe111276566efe
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent. The document body contains text related to 'Affairscloud monthly pdf november 2019', which appears to be a lure to disguise the malicious link farm. The primary attack pattern involves directing users to a network of linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nomorejoemoore.com/uploads/1/3/0/5/130590338/6909668.pdf
    • http://rego.strayhat.com/uploads/1/3/0/7/130739340/27f0a.pdf
    • http://bestquotesdaily.com/uploads/1/3/0/4/130488410/tiwuw.pdf
    • http://napervillebedbugs.com/uploads/1/3/0/7/130739564/9360987.pdf
    • http://bootifulbabyboutique.com/uploads/1/3/0/7/130739983/tevopetada-wupip-monaf-moluxudekekib.pdf
    • http://thespkez.com/uploads/1/3/0/2/130271201/zuzamolufoxap-walexu.pdf
    • http://readyplayerone.store/uploads/1/3/0/3/130313306/tolusijuzev_resenitome_vepurujomupi_redimebo.pdf
    • http://austinapartmentsexpress.com/uploads/1/3/0/6/130604195/bazowuxa.pdf
    • http://www.thefivestrong.com/uploads/1/3/0/6/130640114/0b618274ab29.pdf
    • http://www.batiste-maurer-evans.net/uploads/1/3/0/6/130620902/0e8a3ff9254c.pdf
    • http://mobilosophy.com/uploads/1/3/0/6/130621503/wabaxev-tinukiziru-rejixixivogapil.pdf
    • http://www.mkwritingsolutions.co.uk/uploads/1/3/0/5/130589268/3598210.pdf
    • http://moriahellamason.com/uploads/1/3/0/3/130313471/dusiwukamesekigo.pdf
    • http://hostmaster.jaqchaseart.com/uploads/1/3/0/4/130435876/1584959.pdf
    • http://clermontbasketball.com/uploads/1/3/0/7/130739190/53eed74ace434.pdf
    • http://namanufacturing.com/uploads/1/3/0/8/130814115/bfeace.pdf
    • http://sannasol.com/uploads/1/3/0/7/130739810/siviwinetaje.pdf
    • http://chinhxacmuctieu.com/uploads/1/3/0/2/130288682/1228378.pdf
    • http://caitlindoula.com/uploads/1/3/0/7/130738562/4143037.pdf
    • http://host152.carmichaelnl.com/uploads/1/3/0/5/130543386/130543386.html#affairscloud+monthly+pdf+november+2019

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000351e.bin
07a75e32ced84dad9637fe391a1b2f30feb0da47203a25d8e94175e6acecc799		 pdf-font-stream PDF embedded font (sfnt) at offset 0x351E 8464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.