Malicious PDF — malware analysis report

Static analysis result for SHA-256 db5aa8f58f18cf2e…

MALICIOUS

PDF

69.3 KB Authoring application: Scribus
MD5: 3f897b248a091bbeff4548bce424442b SHA-1: ea7cf4217f61a9c7ee62a4bf33be3750629cb914 SHA-256: db5aa8f58f18cf2e4d96a22587d4feaab5e3d0f3e1ccca4402720c7780b52e40
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious payloads. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample, and the document body contained mostly obfuscated or binary data, making a more precise determination of the ultimate goal difficult.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ucdllp.com/uploads/1/3/0/5/130551378/5153805.pdf
    • http://www.nickwood.org/uploads/1/3/0/5/130590545/korodoneri.pdf
    • http://mergny.be/uploads/1/3/0/5/130589122/bb40305c9a602e.pdf
    • http://monaco-trade.com/uploads/1/3/0/5/130550700/4573684.pdf
    • http://indenizadpvat.net/uploads/1/3/0/7/130739032/zanirutosinijut.pdf
    • http://www.iambrianodonovan.com/uploads/1/3/0/3/130323172/888920.pdf
    • http://youngamericasings.info/uploads/1/3/0/2/130271042/274846.pdf
    • http://morrisplantnursery.com/uploads/1/3/0/4/130476462/4170697.pdf
    • http://ngashstudio.com/uploads/1/3/0/8/130873740/kazifo.pdf
    • http://ctkyakima.com/uploads/1/3/0/7/130776489/9771869.pdf
    • http://thestorystudiohk.com/uploads/1/3/0/6/130639170/dunujokewura.pdf
    • http://restorativemovement.co.uk/uploads/1/3/0/4/130435862/tisugipavunotupajodo.pdf
    • http://orcharddistrictneighborhood.com/uploads/1/3/0/6/130621194/fuwamuwiwa.pdf
    • http://atastingevent.com/uploads/1/3/0/5/130540814/a69f3d5d6526162.pdf
    • http://hasbara.ca/uploads/1/3/0/2/130271224/9819414.pdf
    • http://www.mrscardosi.com/uploads/1/3/0/5/130545396/sizeduz.pdf
    • http://brandtgalleries.com/uploads/1/3/0/5/130543538/poxisopi_salos.pdf
    • http://jonathanpschwartz.com/uploads/1/3/0/6/130621351/130621351.html#hindi+typing+chart+full+hd+image

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066fc.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66FC 1388 bytes
font_01_sfnt_off00006de4.bin
ca889182d22413b1a5b6446cd5d954c095bfc2c8b2fec1022b19199100617195		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DE4 16028 bytes
font_02_sfnt_off000084e2.bin
b9e04b66b53e125935fcd3adf0afaa730a338abfc359d9d310c09745713fcc66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84E2 7780 bytes
font_03_sfnt_off0000a2eb.bin
63f81a7ebcd9f9e5e7f400c30740f3f8f42766d9d36b0b85e5afa2c037ad44f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA2EB 17352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.