Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0c9250c94ccfb6b…

MALICIOUS

PDF

43.0 KB Authoring application: Soda PDF
MD5: 1b9dd7700a9ec2313cc3173bfec78d8e SHA-1: 85e9515ccc4ced86ff165770652ec6bcedecbd34 SHA-256: e0c9250c94ccfb6b1a7c55feea1f811bf9dfd1e27bb0e93d785bc56876472b42
180 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to other PDF files, a common technique for SEO poisoning and distributing malicious content. The document body, though truncated, suggests a lure related to a 'verizon file claim' and mentions 'Asurion', indicating a potential phishing or scam attempt. The heuristics confirm this, flagging it as a callback lure and a payment redirection lure, consistent with business email compromise tactics. ClamAV detection further supports its malicious classification as Pdf.Phishing.TtraffRobotInstall.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://301southdallas.com/uploads/1/3/0/4/130483811/zizijukomufem.pdf
    • http://americanbedbreakfast.com/uploads/1/3/0/7/130775304/536077.pdf
    • http://allegroacademy.net/uploads/1/3/0/4/130476458/da89dda3872b.pdf
    • http://www.lifechangesinc.com/uploads/1/3/0/2/130272513/badasedite.pdf
    • http://fancyfeatheredfarm.com/uploads/1/3/0/6/130604069/dogipogitaxonerew.pdf
    • http://nikosmarinos.com/uploads/1/3/0/5/130551302/solotefaz.pdf
    • http://arielledollinger.com/uploads/1/3/0/4/130490786/xogopolusasok.pdf
    • http://teatroweb.com/uploads/1/3/0/2/130289177/wunakuwi-rokez-damufu.pdf
    • http://nomadworkgear.com/uploads/1/3/0/4/130476271/2516086.pdf
    • http://level7atl.com/uploads/1/3/0/6/130622073/67c8ddb3d.pdf
    • http://thoughtsandimpressions.org/uploads/1/3/0/4/130476229/venilalesin.pdf
    • http://bardswine.com/uploads/1/3/0/4/130488401/defda.pdf
    • http://www.michaelsilveyiptec.com/uploads/1/3/0/6/130604896/4480740.pdf
    • http://root.website84.com/uploads/1/3/0/5/130588843/f2a6d36a2c1bb9b.pdf
    • http://tattoovictoriatexas.com/uploads/1/3/0/4/130489240/tezunizoze_nibineterobe_zetibenokejuxor_dujokimifib.pdf
    • http://bluesheeppainting.com/uploads/1/3/0/6/130622023/xivelutukojefa_wavowotubaw.pdf
    • http://www.establishingtherword.me/uploads/1/3/0/7/130738917/8969298.pdf
    • http://www.mindgoals.co.uk/uploads/1/3/0/5/130550703/5066441.pdf
    • http://labtcenter.com/uploads/1/3/0/4/130476158/povivoferax.pdf
    • http://www.mooredems.com/uploads/1/3/0/7/130738730/43911f7c7e.pdf
    • http://education2.org/uploads/1/3/0/6/130605156/1390582.pdf
    • http://mycreativeservices.space/uploads/1/3/0/6/130639438/1711961.pdf
    • http://bigbonedfitness.com/uploads/1/3/0/6/130640174/53ed5425e.pdf
    • http://media.pharmac.govt.nz/uploads/1/3/0/5/130590622/65faedad.pdf
    • http://4u8qy1.bdgct.com/uploads/1/3/0/6/130620881/130620881.html#asurion+verizon+file+claim
    • http://bardswine

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d60.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D60 16036 bytes
font_01_sfnt_off00004459.bin
e64eaf961989ac0783bc8c1930b420e7bfbae0775f0f7d6f70367110f403f4bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4459 7884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.