Malicious PDF — malware analysis report

Static analysis result for SHA-256 f03860c5896d5e6a…

MALICIOUS

PDF

46.0 KB Authoring application: PDFedit
MD5: d83623baff9ba131e1f36957f39ef6e2 SHA-1: 117237c4ea7ff4a08e1d28ed084f481b67c9686f SHA-256: f03860c5896d5e6a516432c4ddb6957a3c604ac2996748dd20ae40525db37e4b
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The file is a PDF containing a large number of embedded links to other PDF files hosted on various domains, indicative of a link farm or phishing campaign. The heuristic 'SE_CALLBACK_LURE' suggests the document's content is designed to trick users into calling a phone number, likely for a scam. The ClamAV detection further confirms its malicious nature as 'Pdf.Phishing.TtraffRobotInstall'. The embedded URLs are the primary IOCs.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://onesimplyiris.com/uploads/1/3/0/5/130539099/ff980fa75.pdf
    • http://slforeignpolicy2017.lk/uploads/1/3/0/4/130476974/1426fb.pdf
    • http://slmgrp.com/uploads/1/3/0/6/130604182/fusuxuf-popak.pdf
    • http://mrbrushgrade5.ca/uploads/1/3/0/5/130538870/jateve.pdf
    • http://bungareelabradoodlepups.com/uploads/1/3/0/6/130604441/fa0d6c.pdf
    • http://typebtriathlete.com/uploads/1/3/0/6/130640101/pipurodaz.pdf
    • http://pastandpresentmedia.com/uploads/1/3/0/7/130739341/jujetaje.pdf
    • http://themanadvice.com/uploads/1/3/0/4/130435985/jibivewomezejug.pdf
    • http://modtran7.net/uploads/1/3/0/4/130488365/1923755.pdf
    • http://screenwriting.biz/uploads/1/3/0/6/130603906/5767737.pdf
    • http://blockchainambassador.ca/uploads/1/3/0/3/130313610/130313610.html#walgreens+clinic+pricing

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000120a.bin
be491205d891d27019f0388ab3cad03db3faedbee996c20601736172e5200a5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120A 9344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.