Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c8aaf6f43b5ac15…

MALICIOUS

PDF

38.1 KB Authoring application: Karbon First seen: 2021-02-09
MD5: 559c850a6e32efccd05df75dbad66149 SHA-1: 9c54aa17755d9e1d89a28365a209b778c3cd8e43 SHA-256: 2c8aaf6f43b5ac15874ddc2c7fc5979797aa441b6cca0c2635e3ab91218ee680
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://viwelar.veronicaasorey.com/uploads/2020/01/28/5853313.pdf In PDF document text
    • http://fegajed.americanadeidiomas.com/uploads/2020/01/27/7c1a9cfd0de97a.pdfIn PDF document text
    • http://propiedadesfibrastextiles.com/uploads/2020/01/27/runexabuka-tikubaxajubeke.pdfIn PDF document text
    • http://abylcoaching.com/uploads/1/3/0/5/130588693/391922.pdfIn PDF document text
    • http://pahasapagrotto.com/uploads/1/3/0/6/130620266/fc2034.pdfIn PDF document text
    • http://ntcigraffiti.com/uploads/1/3/0/6/130621082/5467100.pdfIn PDF document text
    • http://zajon.miradorbascamao.com/uploads/2020/01/28/92694fdf86d8d.pdfIn PDF document text
    • http://flabgu.com/uploads/2020/01/28/sikut_lefemawaderomix_gotonogojiko.pdfIn PDF document text
    • http://kizawix.dateloveers.online/uploads/2020/01/29/9962311.pdfIn PDF document text
    • https://wilukitivuj.weebly.com/uploads/1/3/0/5/130541600/8466002.pdfIn PDF document text
    • http://graffitigreek.com/uploads/1/3/0/2/130289185/5079104.pdfIn PDF document text
    • http://uuqqprt.info/uploads/2020/01/28/wekux_sisebataj_wiwerulibev.pdfIn PDF document text
    • http://mobilenaturalmedicine.com/uploads/1/3/0/5/130588487/towikimebapasef.pdfIn PDF document text
    • http://designsbycarolann.com/uploads/1/3/0/4/130476317/633082.pdfIn PDF document text
    • https://pinikajawixo.weebly.com/uploads/1/3/0/4/130483616/jotawusosolunemete.pdfIn PDF document text
    • http://securitycamerasofatlanta.com/uploads/1/3/0/5/130550925/7733984.pdfIn PDF document text
    • http://chocolaticity.net/uploads/1/3/0/6/130621457/130621457.html#camp+rock+songs++musicpleerIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001464.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1464 8032 bytes
SHA-256: 91ad5aece5f532e2a7d0b77d66cf8e842fed15a12716a692b3a9eff353f7bca6

Open this report in the interactive analyzer, or submit your own file for analysis.