Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbbc741bb1dc660c…

MALICIOUS

PDF

41.0 KB Authoring application: Scribus
MD5: 71743e54c687b3d7c096bbff6c003ac6 SHA-1: 7064fc3170b60d07aebebbd5e196d726b6363d7b SHA-256: bbbc741bb1dc660cfcbe316a7d8f2b764b70cd107f7a29077b634b5ef8634bdf
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.003 Phishing: Spearphishing Attachment T1204.001 User Execution: Malicious Link

The sample is a PDF containing a large number of external links, which is characteristic of an SEO link farm used to manipulate search engine rankings and lure users to malicious sites. The document body contains fragmented text referencing 'Autodesk inventor 2016 student version', acting as a lure. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall' further supports the phishing nature of this file.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dirtysoles305.com/uploads/1/3/0/5/130544321/gomabumegogodokoz.pdf
    • http://sirb-os-penicheiros.weebly.com/uploads/1/3/0/5/130589260/6190821.pdf
    • http://drewgrahamart.com/uploads/1/3/0/4/130435738/0f4fed52b9e09.pdf
    • http://myvanessaonline.com/uploads/1/3/0/4/130488299/4859576.pdf
    • http://astarboards.com/uploads/1/3/0/6/130604919/8762294.pdf
    • http://stanleycovington.com/uploads/1/3/0/2/130273814/sirimefer.pdf
    • http://ruroloz.cardesign.su/uploads/2020/01/27/e9ed8499ca5.pdf
    • http://lets-split.com/uploads/1/3/0/6/130604588/1188017.pdf
    • https://fusutavakawiti.weebly.com/uploads/1/3/0/5/130588775/e59fd.pdf
    • https://lokuxumuvado.weebly.com/uploads/1/3/0/2/130288924/966554a3b4a8b4.pdf
    • https://gevogiduxiwim.weebly.com/uploads/1/3/0/4/130435741/1024025.pdf
    • http://mhevesi.com/uploads/1/3/0/5/130543057/sububutesudivo.pdf
    • http://nowbiz.net/uploads/1/3/0/6/130604706/253d8bc4abc5.pdf
    • http://moxijix.uzv-rf.ru/uploads/2020/01/29/1734108.pdf
    • http://8200doral.com/uploads/1/3/0/5/130588480/pamegazidipoj.pdf
    • http://usconsulting.us/uploads/1/3/0/4/130483052/rilumu_jenimuzimimokuw_jazajo_nirogufu.pdf
    • http://anatoly-nikolsky.com/uploads/1/3/0/5/130590637/2540a.pdf
    • https://botukiberep.weebly.com/uploads/1/3/0/2/130272616/wefak-vudimulopulozog-mugilalaluva-famevuzuzawa.pdf
    • http://robertdickstudionyc.com/uploads/1/3/0/2/130274282/linubexa.pdf
    • https://gubanolib.weebly.com/uploads/1/3/0/5/130551378/fb4cf6c06bbc.pdf
    • http://wallgears.com/uploads/1/3/0/6/130605016/bidevuzosax.pdf
    • http://allahand.com/uploads/1/3/0/5/130551604/5557389.pdf
    • http://arabshortfilmfactory.com/uploads/1/3/0/5/130545333/bafe928717.pdf
    • http://thehnossaproject.com/uploads/1/3/0/2/130289226/130289226.html#autodesk+inventor+2016+student+version

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016e5.bin
dc878078f5d21af615e3d9583a64ba5dd3d5adf7c9feab3d69901d996ac6b8a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16E5 8676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.