Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1ba8d2fd5b08544…

MALICIOUS

PDF

95.5 KB Authoring application: Poppler-utils First seen: 2020-09-24
MD5: d3230e2e6b4d3dcab60c1e3a088791d6 SHA-1: 5204e506e32a17bf42e363f0b1a22f35aeb4c8a6 SHA-256: d1ba8d2fd5b08544910745d47a2fa475d4f0f6257716fce98ec354d7d4e5fc9c
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file exhibits a critical heuristic firing for a link farm, containing 31 external PDF links, with the first being http://providence-title.com/uploads/1/3/0/3/130312998/sudorufaloleba_vudux.pdf. Additionally, a medium severity heuristic indicates a callback phishing lure, suggesting the document prompts users to call a phone number in a deceptive context. The ClamAV detection further confirms its malicious nature as Pdf.Phishing.TtraffRobotInstall-7605656-0. The embedded URLs and the nature of the heuristics strongly suggest a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://providence-title.com/uploads/1/3/0/3/130312998/sudorufaloleba_vudux.pdf In PDF document text
    • http://hellomaychua.com/uploads/1/3/0/2/130272921/fcece375e2357.pdfIn PDF document text
    • http://www.108infinity.com/uploads/1/3/0/5/130550994/xiwifotafewa.pdfIn PDF document text
    • http://nelsononline.net/uploads/1/3/0/6/130605278/dcad233ca88bf7.pdfIn PDF document text
    • http://4ufurnituredesign.com/uploads/1/3/0/5/130539691/bffe717.pdfIn PDF document text
    • http://www.vidafitnessparis.fr/uploads/1/3/0/7/130775627/a6a533.pdfIn PDF document text
    • http://acwhk.org/uploads/1/3/0/7/130776279/gojawolilogezuj.pdfIn PDF document text
    • http://www.blackwomensyogaretreats.com/uploads/1/3/0/6/130605263/tebitodifidebiwi.pdfIn PDF document text
    • http://pburg94rescue.org/uploads/1/3/0/4/130489437/4315309.pdfIn PDF document text
    • http://breakingbadhouse.com/uploads/1/3/0/2/130271224/mibabupolevuse-jobumevun.pdfIn PDF document text
    • http://haccpseminar.com/uploads/1/3/0/7/130740320/fd74d1bf90f87eb.pdfIn PDF document text
    • http://mycambodonuts.com/uploads/1/3/0/7/130776525/nopemebozipivopu.pdfIn PDF document text
    • http://jeremyandkristina.com/uploads/1/3/0/5/130543289/vezasojebuxit.pdfIn PDF document text
    • http://www.exoticbulliessale.com/uploads/1/3/0/7/130738781/fisuruviwa.pdfIn PDF document text
    • http://alexnicoll.com/uploads/1/3/0/7/130776812/pesogi.pdfIn PDF document text
    • http://auto-pneumatyka.pl/uploads/1/3/0/8/130813496/vanoxeselokonip.pdfIn PDF document text
    • http://giaradioministry.com/uploads/1/3/0/6/130621128/wavuzemafejipufanopo.pdfIn PDF document text
    • http://chestnutpost.com/uploads/1/3/0/5/130550706/vodibebuv_gonipi_wawotix_vesevunebe.pdfIn PDF document text
    • http://newyorkhomeclick.com/uploads/1/3/0/4/130483576/6095160.pdfIn PDF document text
    • http://laughtercare.org/uploads/1/3/0/3/130379098/patelifip-gagemoja.pdfIn PDF document text
    • http://precisionappliancerepair.org/uploads/1/3/0/7/130776085/lazumer.pdfIn PDF document text
    • http://greenwolfverticalfarm.com/uploads/1/3/0/6/130620348/130620348.html#acog+pap+guidelines+pdfIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000119e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119E 10336 bytes
SHA-256: 2a094ec69ec1cbd547abbf0afe745fddcbbc4749ab8a3dcc4cc620d4a8e9c0a1

Open this report in the interactive analyzer, or submit your own file for analysis.