Malicious PDF — malware analysis report

Static analysis result for SHA-256 57c60bad865873e5…

MALICIOUS

PDF

46.9 KB Authoring application: Inkscape
MD5: 8c4ef80f02d664469bfa0f00404931b4 SHA-1: 9c46dce00e531e958076824328d720539800828b SHA-256: 57c60bad865873e54581848f49984319af41a417d02322b3314682aa2cf80dfb
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDFs, a technique often used for SEO manipulation or to distribute malicious content. The heuristic 'SE_CALLBACK_LURE' indicates the document body attempts to trick the user into calling a phone number, consistent with callback phishing or tech-support scams. The ClamAV detection further confirms its malicious nature as 'Pdf.Phishing.TtraffRobotInstall'. The embedded URLs are the primary IOCs, likely leading to further malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.hypocrisyofdisco.com/uploads/1/3/0/4/130488304/lasatulojeso.pdf
    • http://mybuzz.com.au/uploads/1/3/0/9/130969703/lunujululidesatu.pdf
    • http://allworxusergroup.com/uploads/1/3/0/7/130739254/5850176.pdf
    • http://rhdesignstudio.com.au/uploads/1/3/0/5/130538891/jukoxupokejurasojak.pdf
    • http://eliteleadsource.com/uploads/1/3/0/5/130589032/5707454.pdf
    • http://eftwithjaneien.com/uploads/1/3/0/7/130738526/2176787.pdf
    • http://cpanel.techabryant.com/uploads/1/3/0/9/130969370/fuputoj.pdf
    • http://adifferentbook.com/uploads/1/3/0/5/130550770/886064107.pdf
    • http://mail.cogolin.be/uploads/1/3/0/5/130540869/d7fd3aabfea805.pdf
    • http://nextivatrainingteam.com/uploads/1/3/0/7/130776564/7026824.pdf
    • http://littlegastronomer.com/uploads/1/3/0/8/130813658/e9b0dbd91c.pdf
    • http://beaute2suit.com.au/uploads/1/3/0/5/130590195/felejekod-nebub-fiburipekafipa-gerokikajofuj.pdf
    • http://reapvalue.net/uploads/1/3/0/6/130621385/8920894.pdf
    • http://starvedrockcountryresort.com/uploads/1/3/0/3/130379504/mopukatopu-disaw.pdf
    • http://kahaani.com.au/uploads/1/3/0/5/130539111/najujowigenoj.pdf
    • http://iamsrvnt.org/uploads/1/3/0/4/130436182/e79820.pdf
    • http://savecomics.com/uploads/1/3/0/6/130621052/zitakajewetin-wakoto.pdf
    • http://anchorcounselingllc.org/uploads/1/3/0/9/130969404/7455177.pdf
    • http://www.teatrforte.pl/uploads/1/3/0/4/130478314/17f692c0.pdf
    • http://bet365yulechengwangzhi.br3h.com/uploads/1/3/0/6/130621588/130621588.html#abellio+greater+anglia+season+ticket+smart+card
    • http://rhdesignstudio.com.au/uplo

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004203.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4203 16036 bytes
font_01_sfnt_off0000591d.bin
65de3ef8200e942d84003f2d86f8ccc0725d99c4de882cb5dac002c280faeaa1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x591D 7876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.