Malicious PDF — malware analysis report

Static analysis result for SHA-256 c649267a327b763f…

MALICIOUS

PDF

33.2 KB Authoring application: Scribus
MD5: a12e4d029da79597102749b6fe6f6aa7 SHA-1: 0e4393f6bcdd0d727d754bfe85f5d992789a5f0a SHA-256: c649267a327b763f89b4b4a929eb8189718e886332d725e1c062f9db144a691e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The presence of numerous embedded URLs pointing to other PDF files suggests a link farm or a distribution mechanism for malicious content. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://natureswaybotanical.com/uploads/1/3/0/4/130476650/4976a66d962b.pdf
    • http://studio1999.shop/uploads/1/3/0/7/130739156/gorabutefovapovipar.pdf
    • http://challengetosociety.org/uploads/1/3/0/5/130540033/momodi.pdf
    • http://kunznator.com/uploads/1/3/0/6/130620506/buten.pdf
    • http://2005viper.com/uploads/1/3/0/6/130604213/lufigigobiwoje_bozenumuwawof_giregovusavowu.pdf
    • http://mycccamp.com/uploads/1/3/0/2/130270823/torux_bekexe_jomodedikis_nizurogewab.pdf
    • http://drlesterleemd.com/uploads/1/3/0/3/130379412/vamafanumepev-niwaz-lofoxepa-nekuwesavizaxu.pdf
    • http://reinasporunacausa.com/uploads/1/3/0/7/130776790/292710.pdf
    • http://myworshipmentor.com/uploads/1/3/0/5/130539059/f1d24d1c96.pdf
    • http://alissajacobscmt.com/uploads/1/3/0/4/130483821/tudaxejex-kijilik-tulopusove.pdf
    • http://tweetstars.com/uploads/1/3/0/5/130543462/d64342c83ab10.pdf
    • http://el024.elrepco.com/uploads/1/3/0/5/130551386/wegepalenaf-leniguz.pdf
    • http://gertieandruth.com.au/uploads/1/3/0/2/130287835/71d8bef6c0a8b9d.pdf
    • http://220-host.stefanaarnio.com/uploads/1/3/0/5/130544232/130544232.html#r+adjectives+to+describe+a+person+with+meaning

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d64.bin
33339594a8b58d11e9ae8b5ef5a4af8ebfddb17ad14571a8d6288bc986d94f95		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D64 6276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.