Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0394b4b7d67d35d…

MALICIOUS

PDF

59.1 KB Authoring application: Karbon First seen: 2021-02-02
MD5: cb84f39fac059d1ba015e6099efcae0c SHA-1: e8e7fd47d0fb6de58cda8e8e59eea49f981e0a7b SHA-256: a0394b4b7d67d35d362db6e717d51152046c510ca5b88816d937ed9a365a77f2
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gebanef.uniquecostumeideas.net/uploads/2020/01/28/dabafa.pdf In PDF document text
    • http://naduxeba.majesticpin.site/uploads/2020/01/27/f1a90c9619af2bf.pdfIn PDF document text
    • http://vekasuvaxi.goriteam.xyz/uploads/2020/01/27/romebul_zilojubine_vetavetifaninul.pdfIn PDF document text
    • http://povo.audiostart31.icu/uploads/2020/01/27/de8f4062d1e.pdfIn PDF document text
    • http://pajowupom.vostok3.ru/uploads/2020/01/27/fanuj-vitajojuninazu.pdfIn PDF document text
    • http://nabe.privat-market.ru/uploads/2020/01/27/xuxomozufowo_bugilutun_rerofevikof.pdfIn PDF document text
    • http://dasisu.best-pokupka5.ru/uploads/2020/01/27/272243a102ad3d.pdfIn PDF document text
    • http://vaj.redping.ru/uploads/2020/01/27/75289.pdfIn PDF document text
    • http://agicole-acces.com/uploads/2020/01/27/kizadakulad.pdfIn PDF document text
    • http://efficientenergy.ru/uploads/2020/01/27/4764108.pdfIn PDF document text
    • http://himarlik.ir/uploads/2020/01/27/wirurisopodowefunali.pdfIn PDF document text
    • http://jikolideke.gosuslugi-moskva.ru/uploads/2020/01/27/mitam.pdfIn PDF document text
    • http://anextrip.ru/uploads/2020/01/28/temolix.pdfIn PDF document text
    • http://vekuvovep.milopoo.com/uploads/2020/01/27/78f936c2.pdfIn PDF document text
    • http://furidan.dienthoaimobile.com/uploads/2020/01/27/kikez-ziraxasuxaval-vemasinoximem-xafaxupa.pdfIn PDF document text
    • http://wafufox.denem3131.com/uploads/2020/01/27/kisagikonerade_turesagudigido.pdfIn PDF document text
    • https://woluvenox.weebly.com/uploads/1/3/0/2/130271211/gilaxavu.pdfIn PDF document text
    • http://makovuxin.solomonka.online/uploads/2020/01/27/rurevunivikalufalajo.pdfIn PDF document text
    • http://gurmen.ru/uploads/2020/01/27/5802359.pdfIn PDF document text
    • http://ziga.otzyvok.com/uploads/16067922.html#romanda+anlat%C4%B1m+teknikleriIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_01_sfnt_off00009fee.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_01_sfnt_off00009fee.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F5 10284 bytes
SHA-256: a261597e095727e200955987f7e5680eaf641640d42f99e2d7ac4142c1afb037
font_01_sfnt_off00009fee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9FEE 16316 bytes
SHA-256: b70f1553fe9f6456b99dc3cf400967fa37d5bed37153ec2fdabccc6d161e0103

Open this report in the interactive analyzer, or submit your own file for analysis.