Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6531cf0f90b804d…

MALICIOUS

PDF

43.1 KB Authoring application: GIMP First seen: 2021-04-10
MD5: f00e3810b2953fd149317e2dbc58fab3 SHA-1: a79e354347ff542ea4a7e7b05e5dac9f92f94ef1 SHA-256: b6531cf0f90b804d6850e0eb3a2f78365d37e1cf66c1a817672051aea94fb0b0
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tujenijidipolat.weebly.com/uploads/1/3/0/5/130589213/8791752.pdf In PDF document text
    • http://mixedattainmentteaching.com/uploads/1/3/0/6/130621506/7766460.pdfIn PDF document text
    • http://mrsscunningham.com/uploads/1/3/0/5/130551898/kejipujuvo.pdfIn PDF document text
    • http://discoverreps.com/uploads/1/3/0/6/130604798/1671a6eb.pdfIn PDF document text
    • http://myartscout.com/uploads/1/3/0/6/130621495/84f49607998.pdfIn PDF document text
    • http://crosleyoutdoorproducts.com/uploads/1/3/0/5/130550961/1382458.pdfIn PDF document text
    • http://veteransmusicfest.com/uploads/1/3/0/4/130488888/130488888.html#fun+math+worksheets+for+6th+grade+printableIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F3 8240 bytes
SHA-256: 66aaa82c773cb19c06e457a027797512200419012d174daf5c4d00d1d6e2c3d0
font_01_sfnt_off00006d9d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D9D 2652 bytes
SHA-256: e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea

Open this report in the interactive analyzer, or submit your own file for analysis.