Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd1a45cc2248a6e0…

MALICIOUS

PDF

48.5 KB Authoring application: Scribus
MD5: ac67d066d995925ec168bbfc0ada852a SHA-1: 550c0dcdbe6a6a8ddea7cb6170703a90592c9943 SHA-256: cd1a45cc2248a6e0efad6576c7c6f76196905d97b286560bb353fb52eeff7825
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flagged this file as malicious, specifically as Pdf.Phishing.TtraffRobotInstall. The embedded URLs likely serve as a link farm to redirect users to malicious content or phishing pages. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tulsaeats.com/uploads/1/3/0/4/130490151/wuvepoke_mepugamulerad.pdf
    • http://theevenbetterlife.com/uploads/1/3/0/2/130288549/rukufedo-vimin.pdf
    • http://lolrednecks.net/uploads/1/3/0/6/130620625/6775541.pdf
    • http://alonbibring.com/uploads/1/3/0/2/130270971/ruwedopuxi.pdf
    • http://afaparents.org/uploads/1/3/0/5/130547078/130547078.html#ansys+spaceclaim+2018

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fff.bin
0420aa18f7136444bdecb20d3a6d4590749ea11d8854ffdc859451bf7bf4d097		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFF 8324 bytes
font_01_sfnt_off00005f81.bin
1eb7d13efb19e2dbbbd287b4bbc1141f3996d0ec1fb528976559de000e70ac42		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F81 12292 bytes
font_02_sfnt_off00008350.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8350 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.