Malicious PDF — malware analysis report

Static analysis result for SHA-256 03d382f61218bff0…

MALICIOUS

PDF

49.4 KB Authoring application: OpenOffice.org
MD5: 3629abbee357750917d5b15833c06347 SHA-1: 5591d4297e0cce2af12bd47d1321529c4e4c5823 SHA-256: 03d382f61218bff05e036ea4144f6d0e8499627078d0681097c6baa0694fe9d8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links to other PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bavarian-opera-academy.com/uploads/1/3/0/5/130551331/8241327.pdf
    • http://modelizmo.org/uploads/1/3/0/4/130476050/furuwekojopisagobu.pdf
    • http://metroattorneyreviews.com/uploads/1/3/0/4/130491166/3062094.pdf
    • http://whatthehellokitty.com/uploads/1/3/0/2/130291689/6757157.pdf
    • http://tardelhotrods.com/uploads/1/3/0/4/130483163/3634402.pdf
    • http://arwuso.com/uploads/1/3/0/7/130776073/kagadatade.pdf
    • http://www.colegiolapatriaoccidete.com/uploads/1/3/0/2/130288761/5045261.pdf
    • http://mrswente.com/uploads/1/3/0/5/130550762/lumiv-pitapawo.pdf
    • http://www.monkeyrocket.co.uk/uploads/1/3/0/4/130483052/golumid.pdf
    • http://michaelmkrueger.net/uploads/1/3/0/6/130640071/83528.pdf
    • http://adventureoutpostsurvivalbags.com/uploads/1/3/0/5/130588220/7404246.pdf
    • http://nancytoofani.com/uploads/1/3/0/7/130775698/xijotageki.pdf
    • http://www.educatingoutsidethebox.com/uploads/1/3/0/6/130639424/1326006.pdf
    • http://judgeammendola.com/uploads/1/3/0/4/130435553/7774785.pdf
    • http://pandoragalway.com/uploads/1/3/0/5/130588150/sugubizurumugiju.pdf
    • http://johngeneralconstruction.com/uploads/1/3/0/2/130289427/likigoz.pdf
    • http://jackbrucker.net/uploads/1/3/0/4/130476262/notepi.pdf
    • http://neilcutting.com/uploads/1/3/0/5/130551023/d78d3ec7c9.pdf
    • http://7levelselling.stefanaarnio.com/uploads/1/3/0/7/130739996/130739996.html#least+count+of+micrometer+screw+gauge+and+vernier+calliper
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004100.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4100 16204 bytes
font_01_sfnt_off000055db.bin
985cbd9ba5b629f1b749d04d852c0eecb5d8ad374186a1044a60da9476420dc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55DB 2788 bytes
font_02_sfnt_off0000627d.bin
458bc552d80c0b09e72dc7ed1bf32f2d987f1d53f33b1fcfe6f0c06963624cf7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x627D 8444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.