Malicious PDF — malware analysis report

Static analysis result for SHA-256 bac17059b8376b99…

MALICIOUS

PDF

36.5 KB Authoring application: LibreOffice
MD5: c16b7da96b7791fb3ad39caa553b67d4 SHA-1: 94b28a428c3c988f9f5fb7277aeb9ac994826edf SHA-256: bac17059b8376b99f9f178c3801e128d43ea502533297c72f5892df18936f99e
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, a common tactic for SEO poisoning or redirecting users to malicious sites. The heuristic 'SE_CALLBACK_LURE' indicates the document body contains text designed to trick the user into calling a phone number, consistent with callback phishing or tech-support scams. The ClamAV detection further supports its malicious nature. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seminaryplazaexxon.com/uploads/1/3/0/3/130312923/tugixegavefopo.pdf
    • http://spencertunickbooks.com/uploads/1/3/0/5/130552097/f52792f0b5828bd.pdf
    • http://mrvsteaks.com/uploads/1/3/0/5/130551390/6b0b3771eb98d.pdf
    • http://holypostdigital.com/uploads/1/3/0/6/130639590/4642a86.pdf
    • http://brilliantbusinesssolutionsllc.com/uploads/1/3/0/5/130589412/gixovivameko_kupaker_fujuluwuxub_sifawatadilero.pdf
    • http://thenothingman.com/uploads/1/3/0/7/130775511/lurijabet-dodolef.pdf
    • http://txacu.com/uploads/1/3/0/6/130621106/davarofosero-mobinixupa.pdf
    • http://freebearproject.org/uploads/1/3/0/7/130775436/4929546.pdf
    • http://www.earnwithbeautyproducts.com/uploads/1/3/0/6/130640033/5d32472cb6.pdf
    • http://rihgreetings.com/uploads/1/3/0/4/130494801/5436c7.pdf
    • http://nexisnailsystems.com/uploads/1/3/0/5/130589391/130589391.html#mean+median+mode+grouped+data+excel

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000375b.bin
183d8d7e91e766e2fd9522465356a5fc2dac58cc7e78e361f414867ba496ea7d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x375B 8428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.