Malicious PDF — malware analysis report

Static analysis result for SHA-256 db5aa8f58f18cf2e…

MALICIOUS

PDF

69.3 KB Authoring application: Scribus First seen: 2020-09-24
MD5: 3f897b248a091bbeff4548bce424442b SHA-1: ea7cf4217f61a9c7ee62a4bf33be3750629cb914 SHA-256: db5aa8f58f18cf2e4d96a22587d4feaab5e3d0f3e1ccca4402720c7780b52e40
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious payloads. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample, and the document body contained mostly obfuscated or binary data, making a more precise determination of the ultimate goal difficult.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ucdllp.com/uploads/1/3/0/5/130551378/5153805.pdf In PDF document text
    • http://www.nickwood.org/uploads/1/3/0/5/130590545/korodoneri.pdfIn PDF document text
    • http://mergny.be/uploads/1/3/0/5/130589122/bb40305c9a602e.pdfIn PDF document text
    • http://monaco-trade.com/uploads/1/3/0/5/130550700/4573684.pdfIn PDF document text
    • http://indenizadpvat.net/uploads/1/3/0/7/130739032/zanirutosinijut.pdfIn PDF document text
    • http://www.iambrianodonovan.com/uploads/1/3/0/3/130323172/888920.pdfIn PDF document text
    • http://youngamericasings.info/uploads/1/3/0/2/130271042/274846.pdfIn PDF document text
    • http://morrisplantnursery.com/uploads/1/3/0/4/130476462/4170697.pdfIn PDF document text
    • http://ngashstudio.com/uploads/1/3/0/8/130873740/kazifo.pdfIn PDF document text
    • http://ctkyakima.com/uploads/1/3/0/7/130776489/9771869.pdfIn PDF document text
    • http://thestorystudiohk.com/uploads/1/3/0/6/130639170/dunujokewura.pdfIn PDF document text
    • http://restorativemovement.co.uk/uploads/1/3/0/4/130435862/tisugipavunotupajodo.pdfIn PDF document text
    • http://orcharddistrictneighborhood.com/uploads/1/3/0/6/130621194/fuwamuwiwa.pdfIn PDF document text
    • http://atastingevent.com/uploads/1/3/0/5/130540814/a69f3d5d6526162.pdfIn PDF document text
    • http://hasbara.ca/uploads/1/3/0/2/130271224/9819414.pdfIn PDF document text
    • http://www.mrscardosi.com/uploads/1/3/0/5/130545396/sizeduz.pdfIn PDF document text
    • http://brandtgalleries.com/uploads/1/3/0/5/130543538/poxisopi_salos.pdfIn PDF document text
    • http://jonathanpschwartz.com/uploads/1/3/0/6/130621351/130621351.html#hindi+typing+chart+full+hd+imageIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x66FC 1388 bytes
SHA-256: 1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0
font_01_sfnt_off00006de4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DE4 16028 bytes
SHA-256: ca889182d22413b1a5b6446cd5d954c095bfc2c8b2fec1022b19199100617195
font_02_sfnt_off000084e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84E2 7780 bytes
SHA-256: b9e04b66b53e125935fcd3adf0afaa730a338abfc359d9d310c09745713fcc66
font_03_sfnt_off0000a2eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA2EB 17352 bytes
SHA-256: 63f81a7ebcd9f9e5e7f400c30740f3f8f42766d9d36b0b85e5afa2c037ad44f1

Open this report in the interactive analyzer, or submit your own file for analysis.