Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe71990c3f74c2b6…

MALICIOUS

PDF

38.3 KB Authoring application: Scribus First seen: 2020-09-15
MD5: 7e30a5a972e82447e87ee4bb433661b4 SHA-1: e360b350f23c7a0f95ad42b53be88f53599a029f SHA-256: fe71990c3f74c2b669faa0338e9f5bf57758e59e3dee644e5d84f1f7340df740
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection intent. No scripts were extracted from this sample, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lelekonto.net/uploads/1/3/0/7/130739474/zaridajitexu_bexifobel_maxaku_robinejuxudatof.pdf In PDF document text
    • http://www.rhythmknitsyarn.com/uploads/1/3/0/8/130814290/7905697.pdfIn PDF document text
    • http://www.alvarezorganics.com/uploads/1/3/0/6/130620380/tijuwozetizupu.pdfIn PDF document text
    • http://simplysarahsmeals.com/uploads/1/3/1/0/131069777/8623731.pdfIn PDF document text
    • http://reimaginingwellness.com/uploads/1/3/0/5/130542934/c01882077dd97.pdfIn PDF document text
    • http://www.mcjsecurity.com/uploads/1/3/0/3/130313366/daridoxibutiwaduto.pdfIn PDF document text
    • http://hclcmsdodgecity.org/uploads/1/3/0/6/130621683/ab3d580b1c0c.pdfIn PDF document text
    • http://mta-sts.mx.normandy-battlefield-tour-guides-association.com/uploads/1/3/0/7/130738537/753022900a41.pdfIn PDF document text
    • http://claremonttaxservice.com/uploads/1/3/0/6/130603922/pokubibu.pdfIn PDF document text
    • http://proofoflife.com.au/uploads/1/3/0/6/130605002/b921f55f.pdfIn PDF document text
    • http://nowthenfuture.com/uploads/1/3/0/7/130738543/5764270.pdfIn PDF document text
    • http://www.modestoclimatizacaoeenergiasolar.com/uploads/1/3/0/6/130605312/5780790.pdfIn PDF document text
    • http://elizabethbriskin.com/uploads/1/3/0/2/130270804/wivibiwan_woxigadi_fijobivuw.pdfIn PDF document text
    • http://artm.website/uploads/1/3/0/5/130588895/zokibero.pdfIn PDF document text
    • http://davidkarns.net/uploads/1/3/0/7/130775025/vukonataxinuxo.pdfIn PDF document text
    • http://mta-sts.mail.shorelinemarketingsolutions.com/uploads/1/3/0/4/130483886/3727604.pdfIn PDF document text
    • http://jtaginterface.net/uploads/1/3/0/6/130639114/xoxez-kulesazabepun-midugesugi.pdfIn PDF document text
    • http://tree-s-cape.co.za/uploads/1/3/0/7/130738707/4c31b8243a.pdfIn PDF document text
    • http://www.deadpointfilm.com/uploads/1/3/0/9/130969335/6455114.pdfIn PDF document text
    • http://www.lusciouscupcakesandcustomcakes.com/uploads/1/3/0/8/130814011/nibatinifogugagovati.pdfIn PDF document text
    • http://montbros.com/uploads/1/3/0/6/130603737/foxarevujuparufo.pdfIn PDF document text
    • http://uimnt.brdge.org/uploads/1/3/0/4/130478205/130478205.html#free+handwriting+worksheets+for+kindergarten+pdfIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003446.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3446 8116 bytes
SHA-256: 3f6993945a4a01f1cb9176e9c20e7d7ca910fda6754bba4985f53245654f1fe1

Open this report in the interactive analyzer, or submit your own file for analysis.