Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c016b41ac1327d8…

MALICIOUS

PDF

63.5 KB Authoring application: LibreOffice
MD5: 62c5c0db41cdd9d8853d8eed42bdf8cd SHA-1: e2517f94c3f14e645474fabc22fd53988b18ba1d SHA-256: 8c016b41ac1327d8105911391f230a69fd9fc54c93d5bda2010cce3de3b3c4ab
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of external links to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. The heuristic 'SE_CALLBACK_LURE' indicates the document's text is designed to trick users into calling a phone number, consistent with callback phishing or tech-support scams. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious intent. The embedded URLs likely lead to further stages of the attack.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mysss.ca/uploads/1/3/0/2/130288326/refili.pdf
    • http://psupostdoc.org/uploads/1/3/0/5/130551586/8126430.pdf
    • http://northwestlouisianaautomationgroup.com/uploads/1/3/0/5/130588290/jusigedozakuwokipobu.pdf
    • http://remont-msk10.icu/uploads/2020/01/28/5fa58b6926a18.pdf
    • http://mrkellysupholstery.com/uploads/1/3/0/2/130289385/7080477.pdf
    • http://suzanneensmann.com/uploads/1/3/0/5/130543377/mugaliseji_kitemu_sulamolizujanef.pdf
    • http://pawsforacauseinvitational.com/uploads/1/3/0/2/130291556/levoxibupolidaji.pdf
    • http://msh.design/uploads/1/3/0/4/130483810/4347341.pdf
    • http://pholi.net/uploads/1/3/0/4/130490719/541192.pdf
    • http://keppingerlaw.com/uploads/1/3/0/3/130323957/9936212.pdf
    • http://delbertsonrealty.com/uploads/1/3/0/3/130379422/rinabujedesi-zamaxiv.pdf
    • http://kidigenal.ledy-boss.su/uploads/2020/01/29/sigezave.pdf
    • http://djspizza1.com/uploads/1/3/0/6/130604520/130604520.html#contact+dermatitis+journal

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013f2.bin
a63dbfc8f8e50a0c04cc2917dff910b4fd63a48ce72cec1f29b1169705049924		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F2 10012 bytes
font_01_sfnt_off0000bee9.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBEE9 2600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.