Malicious PDF — malware analysis report

Static analysis result for SHA-256 d194e3cac02aef9d…

MALICIOUS

PDF

65.5 KB Authoring application: Scribus
MD5: 92b74aae87175b96a9c26a1aeaed28af SHA-1: 41df1062baef0f73363e4753e458125dd6e97cc8 SHA-256: d194e3cac02aef9dd93a7e66e0b27fdeb5fbd8ed46e7a07c2e814d0279a612d2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious link distribution intent. The document body contains text related to a musical performance, which may serve as a lure. The primary attack pattern involves directing users to a multitude of external PDF files hosted on various domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://11pluscolchester.com/uploads/1/3/0/4/130476221/miguvikejonojaminuga.pdf
    • http://nof.newsvse.ru/uploads/2020/01/29/guwivagolazoba_tisedufevegizof_vixuxetawu_gedoga.pdf
    • http://fewememoto.pcigra.ru/uploads/2020/01/28/4848057.pdf
    • http://skidayz.co/uploads/1/3/0/6/130604195/7f90a5b102.pdf
    • http://nomnomnatural.com.au/uploads/1/3/0/5/130539019/neruzu_fupadarowafefi_gepimojoxeju_gonepafi.pdf
    • http://gigizudox.evanstonfcu.com/uploads/2020/01/27/zeleginobavel.pdf
    • http://vojus.wfcrus.com/uploads/2020/01/27/3241846.pdf
    • http://merkabawellness.com/uploads/1/3/0/3/130313140/0e90cc191722ce.pdf
    • http://doggiestyles.net/uploads/1/3/0/6/130604620/7cdda2f8bc.pdf
    • http://a1412531xstreamtravel.xsideas.com/uploads/1/3/0/4/130436121/636db26e0a91a09.pdf
    • http://official-brands.com/uploads/1/3/0/5/130589460/c2b07a8d4342.pdf
    • http://allamericandogexpo.com/uploads/1/3/0/2/130272937/130272937.html#greatest+love+of+all++whitney

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000143d.bin
6aa853dbb6291aaa50064d55b29fa68ec63dceee2d7329f5a3ccc6a8d2c27556		 pdf-font-stream PDF embedded font (sfnt) at offset 0x143D 9452 bytes
font_01_sfnt_off0000ba49.bin
378288d3133907284a1dd708aec606fa45674349f7e67e9eaedc79a8f6af9139		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBA49 16228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.