Malicious PDF — malware analysis report

Static analysis result for SHA-256 6004399e197f1bc0…

MALICIOUS

PDF

39.6 KB Authoring application: GIMP First seen: 2021-02-20
MD5: f9ed6aa0c3bdc8c518de4afc2aa20f2d SHA-1: f89b8fd40658085c4366554ad50a9a0c934671b9 SHA-256: 6004399e197f1bc0cc786dcb779f9cb163347e8f2209cd063f66197334f4acef
192 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jupe.tamilworldnews247.com/uploads/2020/01/27/9044578.pdf In PDF document text
    • http://malitile.support-copyrights-100362019.info/uploads/2020/01/28/6279255.pdfIn PDF document text
    • http://bozigokom.lightprod.fun/uploads/2020/01/28/dojuweped.pdfIn PDF document text
    • http://tawafokeki.support-accounts.online/uploads/2020/01/27/gotobejejeroto.pdfIn PDF document text
    • http://suremawu.gidmamin.ru/uploads/2020/01/28/xevix-benef-gujafavamaduw.pdfIn PDF document text
    • http://bonuna.kuhni-msc001.icu/uploads/2020/01/27/gulil.pdfIn PDF document text
    • http://guji.antizavtra.ru/uploads/2020/01/28/vemutona.pdfIn PDF document text
    • http://keg.black-port.ru/uploads/2020/01/27/dawofekane_wojuj.pdfIn PDF document text
    • https://sosuzemofevew.weebly.com/uploads/1/3/0/2/130272877/7421389.pdfIn PDF document text
    • http://vujiwawag.xeuns.ru/uploads/2020/01/28/4696667.pdfIn PDF document text
    • http://bookmeup.website/uploads/33545963.html#de+bronceados+de+los+mapas+cruz+nuevIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EE 9676 bytes
SHA-256: cd7075806fa2b168fd84d0844eb2c6957b5ed07e71bb04017f6e15fc179561e1
font_01_sfnt_off00006071.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6071 1764 bytes
SHA-256: 3cf2e61d6a9a17d67058092f735344da68aafd773256a5c2a16702179a7e0181

Open this report in the interactive analyzer, or submit your own file for analysis.