Malicious PDF — malware analysis report

Static analysis result for SHA-256 d20cdbb0834aa441…

MALICIOUS

PDF

42.0 KB Authoring application: Scribus
MD5: bcb55c8296e352cd83f77de9fb0e35b6 SHA-1: 56bf085659bede1390b77c00499287bb83e7e7aa SHA-256: d20cdbb0834aa44104c7482746d881927333851b4fe6b538dbc679f9918e887d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF_SEO_LINK_FARM heuristic indicates the presence of numerous external links, suggesting a phishing or redirection attempt. The embedded URLs are likely part of a link farm designed to distribute malicious content or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://miragabella.com/uploads/1/3/0/4/130436441/5427350.pdf
    • http://westovhell.com/uploads/1/3/0/2/130272260/2c9fe70f1.pdf
    • http://cancelatimesharenow.com/uploads/1/3/0/4/130488578/dafej.pdf
    • http://sewowobi.text-shift.ru/uploads/2020/01/27/sokobumukode-bedebolezami-sexigaboba-gixarufa.pdf
    • http://loweslake.com/uploads/1/3/0/6/130603932/nelofewuto.pdf
    • http://vodedewaka.ladyworld.xyz/uploads/2020/01/28/9447175.pdf
    • http://tmpropertysolutions.com/uploads/1/3/0/4/130435777/8804079.pdf
    • http://jacksonspit.com/uploads/1/3/0/5/130550741/5384059.pdf
    • http://doctorpk.net/uploads/1/3/0/4/130436071/muxatomagujaxi.pdf
    • http://profileperformancedirect.com/uploads/1/3/0/2/130291545/nametilewisu.pdf
    • http://wowolureke.dobrydom.info/uploads/2020/01/28/xevowabumokujo.pdf
    • https://vabinazuwanino.weebly.com/uploads/1/3/0/4/130436125/buxabafilew_fumaxetef_fekireg.pdf
    • http://commercialcleaningvacaville.com/uploads/1/3/0/2/130291531/9d0109849d01ed.pdf
    • http://cyclebavaria.com/uploads/1/3/0/4/130475997/130475997.html#hoi4+millennium+dawn

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013b8.bin
3880367e9608dd86b20a8f763eba5ae8079cdf26d9381f46bfa1469a50d8be29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B8 8672 bytes
font_01_sfnt_off00005b9c.bin
1b040ce6e3d4ca2c571b514299c143f5ec384e5444d57ab89c18a3ee0f3a4429		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B9C 16500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.