Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca722e953c5561ca…

MALICIOUS

PDF

43.1 KB Authoring application: Scribus
MD5: 76131cc5bffdee383374fdf78851b7bb SHA-1: 795d001691e38969ad9cb2f250ecad7d258b8e57 SHA-256: ca722e953c5561ca216695c213a642fddd9b15628ef2d7b7a83876400aaefd21
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO spam attack pattern. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to distributing unwanted content or leading users to malicious sites. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://queenoflimabeans.com/uploads/1/3/0/6/130621701/siwopesisurilizi.pdf
    • http://effectivedistrict.com/uploads/1/3/0/6/130605325/kikorisojusetulumoja.pdf
    • http://smithhaist.com/uploads/1/3/0/2/130270834/5069385.pdf
    • http://mytextsandhumanexperiences.com/uploads/1/3/0/4/130488583/fataramanuza-repoxotubipap.pdf
    • http://bestdiscount.xyz/uploads/2020/01/28/domijatuwig_pamod_wonoteneginewu_zopeke.pdf
    • http://myoptique2020.com/uploads/1/3/0/5/130550885/2508217.pdf
    • http://dinewaw.studio-elephant.ru/uploads/2020/01/29/1009694.pdf
    • http://myshinglesstory.com/uploads/1/3/0/3/130379297/130379297.html#time+calculator+google+sheets

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011e7.bin
f0d854d97ad5f7e2bde1adb00edb4811c82e67b0fcd4c38469ac04a685787290		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E7 8816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.