Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe2537f9975b0ba6…

MALICIOUS

PDF

35.7 KB Authoring application: Scribus
MD5: 8994d131503ef6311045f0721801f995 SHA-1: 3e70efa8a76019fee54aef1ad78643e6c3a06472 SHA-256: fe2537f9975b0ba6cd536eaa817cb1d0b2a69be51092c8036cf8b8531b64731a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection also flags this as a phishing-related PDF. The embedded URLs likely lead to malicious content or further phishing attempts. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mail.tsseafood.com/uploads/1/3/0/6/130604744/4482766.pdf
    • http://www.businesscreator.net/uploads/1/3/0/6/130640044/6121661.pdf
    • http://rajadiveisland.com/uploads/1/3/0/7/130739975/2646683.pdf
    • http://oasisstyle.co/uploads/1/3/0/2/130270775/gefamagovonun-dubexo-kukat.pdf
    • http://socalhelpfulhonda.com/uploads/1/3/0/3/130324030/satokazigixep.pdf
    • http://autodiscover.velvetsecretshair.com/uploads/1/3/0/5/130543166/9ecebe5c5460a.pdf
    • http://dancedietitian.com/uploads/1/3/0/2/130291822/veredup_lusuj.pdf
    • http://brokenglass.website/uploads/1/3/0/2/130271111/lobixaniga.pdf
    • http://www.coastalcustomconstruction.com/uploads/1/3/0/6/130620557/7618700.pdf
    • http://banditbrewhouse.com/uploads/1/3/0/6/130620431/1720842.pdf
    • http://northernkettleswoodshop.com/uploads/1/3/0/2/130289448/vuzixibed.pdf
    • http://troop14holliston.com/uploads/1/3/0/7/130739063/badaluvawogufas_magazi_dobakobowazizo_vinetuwepugu.pdf
    • http://utalange.de/uploads/1/3/0/7/130775472/tifisuwawufumez.pdf
    • http://acceleratecleaning.com/uploads/1/3/0/8/130813518/5988bd75fc602.pdf
    • http://www.courtstrengthllc.com/uploads/1/3/0/5/130551089/tebaxusimeti.pdf
    • http://orendgametables.net/uploads/1/3/0/2/130272511/ff3b1430.pdf
    • http://www.studio17b.com/uploads/1/3/0/7/130775294/8892434.pdf
    • http://pinheadsquilting.com/uploads/1/3/0/9/130969981/navuwut.pdf
    • http://maltaglasscreations.com/uploads/1/3/0/7/130776381/bepur.pdf
    • http://desrochersculpturestudio.com/uploads/1/3/0/8/130814784/jajevukob.pdf
    • http://lanechnge.org/uploads/1/3/0/8/130814933/gudunejigosiv_resag.pdf
    • http://a1542490xstreamtravel.xsideas.com/uploads/1/3/0/5/130589260/130589260.html#english+topics+for+speaking+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002a40.bin
c5154f4f9abf8394bb7d6a9bd18fb682f35631ad065772c870577a98db776625		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A40 8076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.