Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c021019996bf10a…

MALICIOUS

PDF

51.7 KB Authoring application: PDFedit First seen: 2021-02-18
MD5: 89de3220c9197b684bdcef4166e2815e SHA-1: 119a291eb623715510f526bcceacb693b2edf467 SHA-256: 3c021019996bf10ad0e03960957102c16fe8e07f354c7e7395392c5c63a9931e
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://babylon5cards.com/uploads/1/3/0/6/130604764/3337528.pdf In PDF document text
    • http://fundraising-career.com/uploads/1/3/0/6/130620185/026ed7a6cb6.pdfIn PDF document text
    • http://simonbaatz.org/uploads/1/3/0/5/130539940/sibibutilorenazu.pdfIn PDF document text
    • http://y-iptv.net/uploads/1/3/0/4/130479435/812f6523f11f68d.pdfIn PDF document text
    • http://plyosoul.org/uploads/1/3/0/2/130270958/zuxevezulikipi.pdfIn PDF document text
    • http://bricabracmusic.co.uk/uploads/1/3/0/4/130479044/xivinew.pdfIn PDF document text
    • http://wtbest.net/uploads/1/3/0/5/130551463/bowedilu_betefenalitos_bonum.pdfIn PDF document text
    • http://timefreedomhustle.com/uploads/1/3/0/8/130874055/wewobopives.pdfIn PDF document text
    • http://quinne.net/uploads/1/3/0/5/130542734/falozefo.pdfIn PDF document text
    • http://sydneycustomfurniture.com/uploads/1/3/0/7/130776677/puxativuti.pdfIn PDF document text
    • http://bitcointracks.com/uploads/1/3/0/3/130323324/tavapa.pdfIn PDF document text
    • http://education2.org/uploads/1/3/0/5/130589205/vovuxesalota.pdfIn PDF document text
    • http://prestige-overseas.in/uploads/1/3/0/7/130739128/jafamusonalimuj.pdfIn PDF document text
    • http://thesavagegentleman.com/uploads/1/3/0/3/130313624/7f9dfc4f4938.pdfIn PDF document text
    • http://fokujiujitsu.com/uploads/1/3/0/3/130323968/9717071.pdfIn PDF document text
    • http://theunexaminedlifestyle.com/uploads/1/3/0/2/130272250/fa53f.pdfIn PDF document text
    • http://desatascoselpratdellobregat.com/uploads/1/3/0/3/130313081/pegujoduvone.pdfIn PDF document text
    • http://sonnys-closet-trade.com/uploads/1/3/0/2/130289198/jukajami.pdfIn PDF document text
    • http://earthangeledibles.com/uploads/1/3/0/6/130621782/mamazopevutalok.pdfIn PDF document text
    • http://rebuildcm.co/uploads/1/3/0/2/130287835/1536792.pdfIn PDF document text
    • http://wabashtees.com/uploads/1/3/0/4/130488935/7042894.pdfIn PDF document text
    • http://watermelontees.com/uploads/1/3/0/6/130604370/wejirabomafadi_lojawitilob_gisusipujos_zasug.pdfIn PDF document text
    • http://thesummitx.com/uploads/1/3/0/7/130776222/3832241.pdfIn PDF document text
    • http://parksphotography.co.nz/uploads/1/3/0/5/130539583/a96140.pdfIn PDF document text
    • http://millerhahn-wedding.rominastiebenphotography.com/uploads/1/3/0/4/130435835/130435835.html#illustrator+save+artboard+as+aiIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000f03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF03 8808 bytes
SHA-256: ece37e5172648e3642ff1c20345228c45778a8209d6206a94a016c220bc6e045
font_01_sfnt_off00007a6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A6A 2600 bytes
SHA-256: 41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee

Open this report in the interactive analyzer, or submit your own file for analysis.