Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe71990c3f74c2b6…

MALICIOUS

PDF

38.3 KB Authoring application: Scribus
MD5: 7e30a5a972e82447e87ee4bb433661b4 SHA-1: e360b350f23c7a0f95ad42b53be88f53599a029f SHA-256: fe71990c3f74c2b669faa0338e9f5bf57758e59e3dee644e5d84f1f7340df740
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection intent. No scripts were extracted from this sample, limiting the analysis of direct execution capabilities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lelekonto.net/uploads/1/3/0/7/130739474/zaridajitexu_bexifobel_maxaku_robinejuxudatof.pdf
    • http://www.rhythmknitsyarn.com/uploads/1/3/0/8/130814290/7905697.pdf
    • http://www.alvarezorganics.com/uploads/1/3/0/6/130620380/tijuwozetizupu.pdf
    • http://simplysarahsmeals.com/uploads/1/3/1/0/131069777/8623731.pdf
    • http://reimaginingwellness.com/uploads/1/3/0/5/130542934/c01882077dd97.pdf
    • http://www.mcjsecurity.com/uploads/1/3/0/3/130313366/daridoxibutiwaduto.pdf
    • http://hclcmsdodgecity.org/uploads/1/3/0/6/130621683/ab3d580b1c0c.pdf
    • http://mta-sts.mx.normandy-battlefield-tour-guides-association.com/uploads/1/3/0/7/130738537/753022900a41.pdf
    • http://claremonttaxservice.com/uploads/1/3/0/6/130603922/pokubibu.pdf
    • http://proofoflife.com.au/uploads/1/3/0/6/130605002/b921f55f.pdf
    • http://nowthenfuture.com/uploads/1/3/0/7/130738543/5764270.pdf
    • http://www.modestoclimatizacaoeenergiasolar.com/uploads/1/3/0/6/130605312/5780790.pdf
    • http://elizabethbriskin.com/uploads/1/3/0/2/130270804/wivibiwan_woxigadi_fijobivuw.pdf
    • http://artm.website/uploads/1/3/0/5/130588895/zokibero.pdf
    • http://davidkarns.net/uploads/1/3/0/7/130775025/vukonataxinuxo.pdf
    • http://mta-sts.mail.shorelinemarketingsolutions.com/uploads/1/3/0/4/130483886/3727604.pdf
    • http://jtaginterface.net/uploads/1/3/0/6/130639114/xoxez-kulesazabepun-midugesugi.pdf
    • http://tree-s-cape.co.za/uploads/1/3/0/7/130738707/4c31b8243a.pdf
    • http://www.deadpointfilm.com/uploads/1/3/0/9/130969335/6455114.pdf
    • http://www.lusciouscupcakesandcustomcakes.com/uploads/1/3/0/8/130814011/nibatinifogugagovati.pdf
    • http://montbros.com/uploads/1/3/0/6/130603737/foxarevujuparufo.pdf
    • http://uimnt.brdge.org/uploads/1/3/0/4/130478205/130478205.html#free+handwriting+worksheets+for+kindergarten+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003446.bin
3f6993945a4a01f1cb9176e9c20e7d7ca910fda6754bba4985f53245654f1fe1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3446 8116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.