Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2e37d0ca6bc7a46…

MALICIOUS

PDF

56.0 KB Authoring application: ImageMagick
MD5: 124c4643bc697576246d062aae65cef3 SHA-1: 34433a65d7f4370cc5d0880c21bddcc0598a9559 SHA-256: e2e37d0ca6bc7a46899aae514fe519e015835ab9b77cdc9c6e7b8d8727f87d87
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDFs, a technique often used for SEO poisoning or to distribute malicious content. The document body text, though partially corrupted, suggests a lure related to unblocking an ATM card, consistent with callback phishing or tech support scams. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a phishing or malicious redirection intent.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://doulakaribirthservices.com/uploads/1/3/0/6/130604024/2709051.pdf
    • http://namibia-quality-beverages.weebly.com/uploads/1/3/0/5/130538956/eae4c21c65948fe.pdf
    • http://2rtp.weebly.com/uploads/1/3/0/5/130545932/ditobukuzevato_rifeta.pdf
    • http://nagefireka.fmmoduliator.store/uploads/2020/01/29/8444283.pdf
    • http://lkradio.online/uploads/1/3/0/6/130621630/979ddf2722e2d93.pdf
    • https://fumevoluj.weebly.com/uploads/1/3/0/5/130539652/debogu.pdf
    • http://mosquitomaster.net/uploads/1/3/0/3/130323329/lekibiteletonuz.pdf
    • http://mudgleyholidayhouse.com/uploads/1/3/0/2/130273581/763914.pdf
    • http://joescottportfolio.com/uploads/1/3/0/5/130551463/6f4b01d1.pdf
    • http://der.rangoro.pro/uploads/2020/01/29/kozozijukumuviwaki.pdf
    • https://fekevubube.weebly.com/uploads/1/3/0/4/130436354/sojalaxurak.pdf
    • http://sidelkibezposrednikov.ru/uploads/1/3/0/5/130590654/kizolazoges.pdf
    • http://browthreadingstudio.com/uploads/1/3/0/4/130483983/zilifu.pdf
    • http://newstarmuzik.com/uploads/1/3/0/6/130605471/jelow-jipatagogu-wutesa.pdf
    • http://misbailes.com/uploads/1/3/0/4/130435532/130435532.html#sbi+atm+card+unblock+letter+format

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013ed.bin
888df4891c69665acfef0999da6d91f72f487b2f3ea15199ea06643ddedb0175		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13ED 7844 bytes
font_01_sfnt_off00006d44.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D44 16204 bytes
font_02_sfnt_off0000847a.bin
f7410a2b181681f19ec64cf08feca3978f3c6f574432367f515e454b8d0fa506		 pdf-font-stream PDF embedded font (sfnt) at offset 0x847A 14140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.