Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf871ce8c415ae42…

MALICIOUS

PDF

54.4 KB Authoring application: PDFedit
MD5: 425f4190e707b2711009b8d3cb18455f SHA-1: 43d7159736b18ed3e7f83cdac2cc783fd990e311 SHA-256: bf871ce8c415ae4265926f567ee8c31fe98c128917fa31d63e88b69eac0cb496
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file contains a large number of embedded links to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The 'SE_CALLBACK_LURE' heuristic suggests a phishing or tech-support scam context, indicating the links may lead to fraudulent pages. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this document.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://receptivefieldvfx.com/uploads/1/3/0/6/130620198/1735307.pdf
    • http://svreunion.com/uploads/1/3/0/7/130739227/4bd62b792987f.pdf
    • http://balannz.com/uploads/1/3/0/4/130483263/vewusojafitobufufu.pdf
    • http://my-riverside-dui-lawyer.com/uploads/1/3/0/3/130323596/be0f4.pdf
    • https://parakegotam.weebly.com/uploads/1/3/0/2/130289220/razulibetusobif.pdf
    • http://mylifebuilder.org/uploads/1/3/0/4/130483582/793a96fa0d819a.pdf
    • http://waldenconstructioncompany.com/uploads/1/3/0/7/130738564/1695697.pdf
    • http://cserv.org/uploads/2020/01/28/wabozow.pdf
    • http://newanday.host/uploads/1/3/0/6/130639524/484e3d.pdf
    • http://salonsirena.com/uploads/1/3/0/6/130621937/joxedimezi_sajoj_wapufixiji.pdf
    • http://cashxofficial.com/uploads/1/3/0/5/130590569/9642471.pdf
    • http://arcadiagardensllclandscapinganddesign.com/uploads/1/3/0/6/130620927/130620927.html#sbi+home+loan+application+form+word

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012cc.bin
c00bd056261f46c8b9b1204bd698c2d6b7a680274ca76f3bb86bfc01de2bf9de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CC 8460 bytes
font_01_sfnt_off000079bf.bin
21c081c601f7a9d922326fd9cdb817eddda87ef78f5e69df0eeec30a56cc2ccd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x79BF 4324 bytes
font_02_sfnt_off0000880e.bin
8b0144409fb25b0151455c9dbe39f4449f41ca0d8dc6c6b805d76e0a84aad4de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x880E 10512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.