Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8e2993ccef7084f…

MALICIOUS

PDF

59.5 KB Authoring application: Scribus First seen: 2020-09-24
MD5: 6a1d4ce58a81325e903f3bb4a9f73dda SHA-1: d04eb202123aaefe95f5fefc92da8a7d8855e7b7 SHA-256: b8e2993ccef7084f6686057d0c9042aaa243f3b8ef78821ef66d64f2c85861ff
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This strongly suggests a phishing or SEO manipulation attack, aiming to drive traffic to potentially malicious sites. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports this assessment. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nazga.org/uploads/1/3/0/6/130620720/dirosape.pdf In PDF document text
    • http://northlandquiltersguild.weebly.com/uploads/1/3/0/6/130621603/8144286.pdfIn PDF document text
    • http://900cahuenga.com/uploads/1/3/0/5/130589004/8921273.pdfIn PDF document text
    • https://xofupupivi.weebly.com/uploads/1/3/0/5/130588931/kexusewusubaje-kapopotaxako.pdfIn PDF document text
    • http://kissbotr.com/uploads/1/3/0/2/130274315/dinimenesogelim_zoxuj_kafemiwimoko_tofib.pdfIn PDF document text
    • http://xam.testim.tech/uploads/2020/01/28/riruke.pdfIn PDF document text
    • http://shogiforum.net/uploads/1/3/0/2/130273748/bopux_rofotaw.pdfIn PDF document text
    • http://stagedoorproof.com/uploads/1/3/0/6/130622041/6677112.pdfIn PDF document text
    • http://opalgeovision.com/uploads/1/3/0/5/130551463/ea14fd8.pdfIn PDF document text
    • http://precariouslypossible.net/uploads/1/3/0/3/130379243/bakibululizi_pakowel_vabiwawipusadug_lokijagusuloke.pdfIn PDF document text
    • http://newimagesfencing.com/uploads/1/3/0/5/130544118/1509341.pdfIn PDF document text
    • http://daveict.com/uploads/1/3/0/4/130436282/fewikawep.pdfIn PDF document text
    • http://nealeythere.weebly.com/uploads/1/3/0/5/130588845/8577127.pdfIn PDF document text
    • http://nigeriandwarfgoats-minslil1s.weebly.com/uploads/1/3/0/5/130541944/gelisaj.pdfIn PDF document text
    • http://kuv.businessget.ru/uploads/2020/01/28/suvekuridujokov_favubak_vanojo_kimafuzijutel.pdfIn PDF document text
    • http://drjeffbarone.com/uploads/1/3/0/5/130543837/e9c5697f78d.pdfIn PDF document text
    • http://senu.jnvyx.xyz/uploads/2020/01/29/givajogaxebeme-jopizozewebepim-ladojebagefimu-xawitugok.pdfIn PDF document text
    • http://suumc.com/uploads/1/3/0/6/130639607/8660708.pdfIn PDF document text
    • http://msb-art-integration.com/uploads/1/3/0/4/130435943/b4d465.pdfIn PDF document text
    • http://rire.tandr.ru/uploads/2020/01/28/9856339.pdfIn PDF document text
    • https://virofolefi.weebly.com/uploads/1/3/0/2/130291713/temuzavibimabakopoxa.pdfIn PDF document text
    • http://foro.ewrty.xyz/uploads/2020/01/29/kugobezi.pdfIn PDF document text
    • http://bygollycandlesnmore.com/uploads/1/3/0/4/130435637/zuxukewop.pdfIn PDF document text
    • http://betashocks.com/uploads/1/3/0/3/130312953/130312953.html#pokemon+rejuvenation+relationship+guIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://linux.thai.net/projects/fonts-tlwgIn PDF document text
    • http://www.thaitux.infoIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000177d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x177D 8876 bytes
SHA-256: 8e726be55bb75b8e8c38a137160da31ed7747516cf7771c5e8436821fffcb763
font_01_sfnt_off00008496.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8496 3024 bytes
SHA-256: 9388a58babc0f7371ab8b22ddf63e987e79183136421922f1f0f7587c7ca8f0c
font_02_sfnt_off00008e8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8E8C 16100 bytes
SHA-256: 78251bbbea8e2b33592f0a07b78fefd02946cf01f5f91bc0a8fd485a500c36e3
font_03_sfnt_off0000a2ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA2ED 9328 bytes
SHA-256: b8759e7c7d34fe5d9dd270544cf936da851edf2a293449b11895023a041eb4ea

Open this report in the interactive analyzer, or submit your own file for analysis.