Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1d4823b3f603cb2…

MALICIOUS

PDF

36.5 KB Authoring application: SWFTools First seen: 2020-09-07
MD5: 7fd603b289f509f523ec3e5457cb9bd9 SHA-1: d66a5fe933920088aa18e33db19b7b23794c5403 SHA-256: b1d4823b3f603cb2089acb6ee593f7d60fe0fee7546e4b3a1a94db7eda2de661
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or redirect users to potentially malicious websites. The SE_CALLBACK_LURE heuristic also indicates a phishing or scam attempt by prompting the user to call a number in a context of billing or security. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://viewmoral.com/uploads/1/3/0/2/130291822/71ce7eec0e.pdf In PDF document text
    • http://seanhisaka.com/uploads/1/3/0/6/130639854/tatarivi.pdfIn PDF document text
    • http://val-lerieshairdesign.com/uploads/1/3/0/7/130775274/nixodubi-goruvozowezax-fedevezax.pdfIn PDF document text
    • http://nakedtrackdays.net/uploads/1/3/0/2/130272994/3879269.pdfIn PDF document text
    • http://thejuiceunion.com/uploads/1/3/0/5/130542902/ddfa61cf45ceac.pdfIn PDF document text
    • http://southernarizonabds.org/uploads/1/3/0/5/130539002/gojudu-nanapozonobutu.pdfIn PDF document text
    • http://harborlightsgrille.com/uploads/1/3/0/6/130620868/4b8c74a15ee.pdfIn PDF document text
    • http://webmail.dicksonarchitecture.com/uploads/1/3/0/7/130776073/zadabe.pdfIn PDF document text
    • http://furniturelinkasia.com/uploads/1/3/0/7/130776674/916371.pdfIn PDF document text
    • http://nicholemannion.com/uploads/1/3/0/6/130639741/forexogafu_tigapileziro_wusukegon_jegirotagupabas.pdfIn PDF document text
    • http://www.gaiamjewellery.com/uploads/1/3/0/8/130874162/2132982.pdfIn PDF document text
    • http://web4.pleasingfood.com/uploads/1/3/0/6/130639110/130639110.html#mi+airdots+pro+2+price+in+chinaIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003703.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3703 8040 bytes
SHA-256: ef57bca5c36c71147818dbf25d9dedef2410bdd77ab3a00224f1df5620c3887d

Open this report in the interactive analyzer, or submit your own file for analysis.