Malicious PDF — malware analysis report

Static analysis result for SHA-256 f83db793eec8a38a…

MALICIOUS

PDF

39.3 KB Authoring application: Scribus
MD5: bd21a2f8604b59ea4a6bf73a21439caa SHA-1: 4e7f843fef9ea9fc2a0221e2f61fb5cf97ff9308 SHA-256: f83db793eec8a38a30cd72a803d2dfafcccd6236d8baf628f436fa965a7ff7d1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted, limiting the analysis of direct payload execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sinohandicraft.com/uploads/1/3/0/8/130813972/metagibofijovuju.pdf
    • http://mobowlusa.com/uploads/1/3/0/2/130288320/5e66db037f46.pdf
    • http://createinsideout.com/uploads/1/3/0/6/130605229/7841583.pdf
    • http://rejuvenationhealthcenter.net/uploads/1/3/0/6/130620923/lofedivizosexukepo.pdf
    • http://internationalmushroom.shop/uploads/1/3/0/7/130738913/232fde.pdf
    • http://pansionat-chaika.com/uploads/2020/01/27/9392280.pdf
    • http://wonderlandmarketing.com/uploads/1/3/0/5/130540406/5363718.pdf
    • http://room2dream.net/uploads/1/3/0/2/130272613/466ce.pdf
    • http://5pointauto.com/uploads/1/3/0/5/130543588/130543588.html#second+conditional+fun+activity

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011a8.bin
d132b7649aa82b144f9b9cde11d80f4e35a99103a5fbc1dc23049c4881070d28		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A8 8228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.