Malicious PDF — malware analysis report

Static analysis result for SHA-256 d17fd12a421fffdb…

MALICIOUS

PDF

41.5 KB Authoring application: pstoedit
MD5: bbb661f527339a27d368d35174f75e2c SHA-1: 04119bda64a2bf8ed734c8cea1dae84ba85f740d SHA-256: d17fd12a421fffdb1c95f4c49d8a2aa0032c89f2fb58fa5c2f2da3636912de5f
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.003 Phishing: Spearphishing via Service T1204.001 Malicious Link: Malicious Link

The PDF contains a large number of external links, many pointing to PDF files hosted on various domains, indicative of a link farm for SEO manipulation or traffic redirection. Additionally, the document body text, though heavily obfuscated, contains elements suggesting a callback lure, prompting users to call a number for support or to resolve an issue. This combination strongly suggests a phishing or scam campaign designed to direct users to malicious sites or engage them in a fraudulent phone interaction.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://electrotech.vip/uploads/1/3/0/4/130488469/fesuraborigire_jivazufopa.pdf
    • http://cordofcallowsdocumentaryfilm.com/uploads/1/3/0/7/130740266/fufog-miditororodizu-juvogu.pdf
    • http://pitsoulis-lift.gr/uploads/1/3/0/7/130775763/1018181.pdf
    • http://www.kimberlysfarmsflowers.com/uploads/1/3/0/8/130874114/zejutufenakigoneze.pdf
    • http://babyg-lash.com/uploads/1/3/0/3/130313500/dodum-xifufunojo.pdf
    • http://stacey-ramos.com/uploads/1/3/0/3/130379138/ef330a5fb4ea.pdf
    • http://americalibertyforum.com/uploads/1/3/0/6/130605075/82209c733fbc.pdf
    • http://marciapburke.com/uploads/1/3/0/2/130272603/narukan-wevetilevuxu-dokesavoxoliv.pdf
    • http://bluemonsterservice.com/uploads/1/3/0/3/130323139/lefegiwibomoke-goropuw-nudusike.pdf
    • http://cocoearlyebay.com/uploads/1/3/0/7/130739887/fomajuzupirul.pdf
    • http://joyofsyntax.com/uploads/1/3/0/4/130476502/batudiruxulojog_bexedipodivepes_fusurojiso_zapus.pdf
    • http://digitalmortgageloan.co/uploads/1/3/0/4/130477351/vozatugivupojog.pdf
    • http://kateforcouncil.org/uploads/1/3/0/7/130738903/7337341bae7.pdf
    • http://katedunsmoresmith.com/uploads/1/3/0/2/130287514/7191780.pdf
    • http://jaggedpill.com/uploads/1/3/0/5/130588735/d2b007d1a047.pdf
    • http://aloaninthesun.com/uploads/1/3/0/4/130490681/2173873.pdf
    • http://kimchibabe.com/uploads/1/3/0/4/130490245/8463799.pdf
    • http://www.giftforbaby.info/uploads/1/3/0/7/130775503/2258932.pdf
    • http://fdqky3qu.brdge.org/uploads/1/3/0/5/130589014/130589014.html#weighted+average+cost+of+capital+is+used+as+a+discount+rate+because

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035b9.bin
6dc6e07f93ae70488a19e8a398a1c6cda2f5723fc3d3cbe180c5afbb10c3611e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35B9 2864 bytes
font_01_sfnt_off00004278.bin
bb3d6619fcb48d79d7c1fc980ade401816bbffb9d9a2610d84330cea64d6b478		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4278 8468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.