Malicious PDF — malware analysis report

Static analysis result for SHA-256 14c729e155039f5d…

MALICIOUS

PDF

40.0 KB Authoring application: pdf-parser First seen: 2021-01-15
MD5: 552552e814f0c8574f636257d23bfeb0 SHA-1: f62e907bd466e919515d78b59b8df9f532250d92 SHA-256: 14c729e155039f5d1a0108f4fc62579cea949431693bc1fc9d037933bd524be2
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://drandrewwalker.com/uploads/1/3/0/4/130494059/bomemovux.pdf In PDF document text
    • http://thejackedhipster.com/uploads/1/3/0/5/130588512/kalemoz.pdfIn PDF document text
    • http://bc-sd.online/uploads/2020/01/28/dewemagu_bavipaposidajik_jozitametofesa_fuxufimowele.pdfIn PDF document text
    • http://comedianjordanjackson.com/uploads/1/3/0/2/130289311/7429343.pdfIn PDF document text
    • http://tezifiji.indmovieonline.club/uploads/2020/01/28/7405141.pdfIn PDF document text
    • http://worldofcoffee-dublin.com/uploads/1/3/0/6/130620991/2366204.pdfIn PDF document text
    • http://mobilenotaryinca.com/uploads/1/3/0/6/130620389/gixovunoforezof.pdfIn PDF document text
    • http://bfndorganics.com/uploads/1/3/0/5/130543305/130543305.html#libros+de+dise%C3%B1o+de+elementos+mecanicosIn PDF document text
    • http://www.stixfonts.orghttp://www.micropress-inc.comAsIn PDF document text
    • http://www.stixfonts.org/user_license.htmlIn PDF document text
    • http://scripts.sil.org/cms/scripts/page.php?site_id=nrsi&id=OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B0 9004 bytes
SHA-256: 7131b8560ae03c2ddf83b0c938c39d9cc34e96bf86af1d701bb177378a47855c
font_01_sfnt_off00005771.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5771 10532 bytes
SHA-256: 043f89cdc56a6d687dbde9ca708df5d68a479f0504edd5c2f1c61766139dec50

Open this report in the interactive analyzer, or submit your own file for analysis.