Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa8e25a0a627524d…

MALICIOUS

PDF

76.5 KB Authoring application: Scribus
MD5: 01276a9845f8b203edd3dbcb07ba3047 SHA-1: e3268cdaf4c630f745b2154afcddd3a9d75b5dcd SHA-256: fa8e25a0a627524d81045c0288958e32f4b4e94fb38e5be3704331a38e4135a1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. No scripts were extracted, but the PDF structure itself is indicative of a link farm designed to redirect users. The document body contains garbled text and references to the World Cup, likely a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://culebrasailingcharters.com/uploads/1/3/0/6/130620781/kobiwosidodij.pdf
    • http://littlerayrox.com/uploads/1/3/0/5/130590059/somibogesevap.pdf
    • http://masterhercraft.com/uploads/1/3/0/7/130739602/zowesaj.pdf
    • http://southwesterntennisservices.com/uploads/1/3/0/6/130604250/199e28.pdf
    • http://clipture.net/uploads/1/3/0/2/130291585/dc512d223f.pdf
    • http://lockton.services/uploads/1/3/0/7/130739853/dumexigasil.pdf
    • http://obxaerialads.com/uploads/1/3/0/6/130639365/barurokaguna-zotaxenumaxi-botuxet.pdf
    • http://shermansmallengines.com/uploads/1/3/0/2/130273850/nudeburala.pdf
    • http://showhomedesigner.com/uploads/1/3/0/6/130639224/tatiref-vutufukukezile-tanukumit.pdf
    • http://stuccovenetiano.com/uploads/1/3/0/6/130621867/dde49331cb5.pdf
    • http://blueegg.net/uploads/1/3/0/7/130739591/fobevam-dofomeb-pemiwug.pdf
    • http://taosabi.com/uploads/1/3/0/2/130289387/fatupize_xosij.pdf
    • http://aandeapothecary.com/uploads/1/3/0/6/130603882/18af0c143ac07a.pdf
    • http://bremenfamilymartialarts.com/uploads/1/3/0/3/130313155/gezefamikujofa.pdf
    • http://vegetarianspacecadet.com/uploads/1/3/0/6/130620760/4587533.pdf
    • http://systemofexpression.info/uploads/1/3/0/6/130605078/4388466.pdf
    • http://mobolayeinc.com/uploads/1/3/0/5/130589402/d032c9f673a0.pdf
    • http://hansandgretelkindergarten.com.au/uploads/1/3/0/9/130969536/1837009.pdf
    • http://andersoncapsim.com/uploads/1/3/0/8/130814459/riges-zamunaxerebu-xalenuwanu-xexeluvuvab.pdf
    • http://sta-66-99-58-197.ladse.org/uploads/1/3/0/5/130551115/130551115.html#russia+world+cup+2018+places

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003139.bin
0d9b33e73fe756a18070a6dc11b08ade6abe7810bfb98b0fbcb4b0e6ef02f982		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3139 11964 bytes
font_01_sfnt_off0000f21b.bin
7863b829de04ea8b7f5be4d5dae43fa62182e7611f0c3a300d10b316d27db496		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF21B 2732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.