Malicious PDF — malware analysis report

Static analysis result for SHA-256 eed1c1d03a263bb0…

MALICIOUS

PDF

26.2 KB Authoring application: QPDF First seen: 2021-04-10
MD5: a61f4132ad3d0c54c0be5655da572866 SHA-1: 81c9c770468926822b4a4508a0b0bb08755121d7 SHA-256: eed1c1d03a263bb09138a48e6bf4e35b790d602e976c93040b1eb42c92590587
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lafayette-westlafayette.net/uploads/1/3/0/6/130603888/1d29f7a4e.pdf In PDF document text
    • http://laurencegestalt.com/uploads/1/3/0/6/130605263/7260072.pdfIn PDF document text
    • http://camillecharlyart.com/uploads/1/3/0/5/130539518/valeritufik.pdfIn PDF document text
    • http://skilledjoestore.com/uploads/1/3/0/4/130488244/f004469df76a.pdfIn PDF document text
    • http://fractive.io/uploads/1/3/0/6/130604104/jesagup.pdfIn PDF document text
    • http://milledlogs.com/uploads/1/3/0/7/130775267/dugexiwe-jinovazuve.pdfIn PDF document text
    • http://nlelectricservices.com/uploads/1/3/0/6/130639960/130639960.html#irritable+male+syndrome+nhsIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fe1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE1 6652 bytes
SHA-256: 41cd5a235f31e43b7d547b43a06bd36c765bd392fea84bd013f5c896a56565f9

Open this report in the interactive analyzer, or submit your own file for analysis.