Malicious PDF — malware analysis report

Static analysis result for SHA-256 554c66d33fa94b98…

MALICIOUS

PDF

41.9 KB Authoring application: Nitro PDF
MD5: 7c98fea3348b0fa6c8139ca1a2e81037 SHA-1: de4133425e42866b04b9195619e04b1aa6696b89 SHA-256: 554c66d33fa94b984da1ba162758c392a04a7891c260b26742baf75ba196aec3
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified as a "PDF_SEO_LINK_FARM" heuristic. Additionally, a "SE_CALLBACK_LURE" heuristic indicates the document prompts users to call a phone number, consistent with phishing or tech-support scams. The ClamAV detection further confirms its malicious nature. The primary attack pattern involves directing users to a network of external PDF documents, likely for malicious redirection or content hosting.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://upfrontadds.com/uploads/1/3/0/2/130272482/5d8a406.pdf
    • http://mrpsmathclass.com/uploads/1/3/0/6/130639750/labaliwiluwuka.pdf
    • https://tajupumoridudux.weebly.com/uploads/1/3/0/4/130436196/lozojidupoj-nirogenetem.pdf
    • http://aroundtheworldin80minutes.org/uploads/1/3/0/4/130476086/sugel_bofakoliroter_ximadul_rowezuvub.pdf
    • http://love-in-the-afternoon.com/uploads/1/3/0/7/130738825/vuvujibixar.pdf
    • http://nuevaconciencia.info/uploads/1/3/0/2/130288932/dufifesevet_vuxupufupat_zakukotekalufa_lofute.pdf
    • http://nupelicanparty.org/uploads/1/3/0/8/130813876/130813876.html#brighterkind+care+uniforms

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000116e.bin
2e33f720873cee39545c1b727123afd0965b3e8b9de2ea25752a3c9d81073829		 pdf-font-stream PDF embedded font (sfnt) at offset 0x116E 8336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.