PDF malware analysis — malicious · 61191fab99e339c0

MALICIOUS

PDF

46.6 KB Authoring application: Mobipocket Creator First seen: 2021-02-23

MD5: 2d8e865dfc2b28cf77178cdb6d5bd00d SHA-1: 5df58a4d81adc660f5b57e2884a2d0cd087f2ba8 SHA-256: 61191fab99e339c03d8947b264bee14f2a0b0bd9a65a2cf30d4e25aaa5463c10

152 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 3

ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://thetruxperience.com/uploads/1/3/0/2/130288579/suxoboperoluraguro.pdf In PDF document text
- http://bajosa.onlineedu.ru/uploads/2020/01/28/e47f60b5a63ac.pdfIn PDF document text
- http://growlingsteph.com/uploads/1/3/0/5/130548108/c500490f84.pdfIn PDF document text
- http://researchtomorrow.net/uploads/1/3/0/4/130479210/eccc5d76a.pdfIn PDF document text
- http://zoeapos.com/uploads/1/3/0/6/130621196/0378d51c17.pdfIn PDF document text
- http://xoxipefu.10i5.com/uploads/2020/01/28/28f905885d2.pdfIn PDF document text
- http://xdmjzbqsyookc.weebly.com/uploads/1/3/0/6/130604879/vutubokariruwebugake.pdfIn PDF document text
- http://boyde-studios.com/uploads/1/3/0/3/130313186/wukajixetosaj.pdfIn PDF document text
- http://terraholdinggroup.com/uploads/1/3/0/6/130639571/7d91c130d8e5.pdfIn PDF document text
- https://duferegateboja.weebly.com/uploads/1/3/0/4/130489776/1352608.pdfIn PDF document text
- http://artmedcy.com:80/uploads/2020/01/28/tividofora-badodexuguwawit-bexepe.pdfIn PDF document text
- http://tafski.org/uploads/1/3/0/6/130639958/9374402.pdfIn PDF document text
- http://alessertraveledroad.com/uploads/1/3/0/3/130323493/288191.pdfIn PDF document text
- http://mold-a-rama.net/uploads/1/3/0/6/130604789/2132363.pdfIn PDF document text
- http://jarofthreads.com/uploads/1/3/0/5/130551142/4085d037c.pdfIn PDF document text
- http://vicbellbeats.com/uploads/1/3/0/6/130621015/2556659.pdfIn PDF document text
- http://dewiw.rkmw.ru/uploads/2020/01/28/254c26848421.pdfIn PDF document text
- http://northvanmusicacademy.ca/uploads/1/3/0/3/130379317/7bf0afb10d72f.pdfIn PDF document text
- http://mergeweekend.com/uploads/1/3/0/6/130604923/kijuxo-vimafijugakogo-ximiwax-saxituxafa.pdfIn PDF document text
- http://mikebarnescoach.com/uploads/1/3/0/6/130621893/fizovapisadiwo-sofutideb-mexodiw-tosurabu.pdfIn PDF document text
- http://trubdesign.com/uploads/2020/01/29/xojumeli-poweni-likimaremu.pdfIn PDF document text
- http://delvalleechs.weebly.com/uploads/1/3/0/6/130620364/d1522.pdfIn PDF document text
- http://mollymia.com/uploads/1/3/0/4/130476940/130476940.html#exercice+sur+les+accentsIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000017ae.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17AE	10712 bytes
SHA-256: `12bb8bf0dd5943211253385748f8f9b784d646fcddaa36794a4418df7988813d`
`font_01_sfnt_off00007ad3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7AD3	2652 bytes
SHA-256: `e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea`

Open this report in the interactive analyzer, or submit your own file for analysis.