Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0731a1dec710dd7…

MALICIOUS

PDF

37.7 KB Authoring application: OpenOffice.org
MD5: 14d61d6ff6cc0d78b0db203ecd1366c2 SHA-1: 07c1f42816abf8a75bf16336032bed497c7c9bcd SHA-256: c0731a1dec710dd785466968a7e9eb26c4e8e7794efff7d0b077712e7f6956ac
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The primary attack pattern observed is a link farm, with numerous external PDF URLs embedded within the document body. These URLs, such as http://thatcherodyssey.com/uploads/1/3/0/2/130288589/5861699.pdf, likely serve to distribute further malware or engage in SEO spam. No scripts were extracted, but the sheer volume of linked PDFs suggests a coordinated effort to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thatcherodyssey.com/uploads/1/3/0/2/130288589/5861699.pdf
    • http://borocreditrepair.com/uploads/1/3/0/6/130639768/jisatekazor.pdf
    • http://brightlightconstructionllc.com/uploads/1/3/0/4/130435826/65b4c4fc0.pdf
    • http://www.life-of-love.com/uploads/1/3/0/6/130604855/8f02a5.pdf
    • http://thestuffoflegends.net/uploads/1/3/0/7/130776499/dolusa.pdf
    • http://nobuhotelmarbella.devsite-1.com/uploads/1/3/0/6/130604048/kivamasefuxemav-lofaxutuxorof-wilepagizuteru-piredageve.pdf
    • http://sophievmakeupartiste.com/uploads/1/3/0/7/130738960/zizanadopaxul-disinu-pesimomot.pdf
    • http://americanfamilygolf.us/uploads/1/3/0/6/130605258/8285546.pdf
    • http://sitgmo.org/uploads/1/3/0/6/130604956/f40550.pdf
    • http://stuffthatsneat.com/uploads/1/3/0/4/130483957/wesej_kakaxuzase.pdf
    • http://northernlightshockeynj.com/uploads/1/3/0/5/130548070/1141049.pdf
    • http://nissajackman.org/uploads/1/3/0/5/130550782/2284712.pdf
    • http://ernnweb.com/uploads/1/3/0/6/130640104/5189440.pdf
    • http://mx.johnpatrickokeefe.com/uploads/1/3/0/7/130738789/vagavekakalixokem.pdf
    • http://springbrookaerospace.com/uploads/1/3/0/2/130291922/vawapekatexizon.pdf
    • http://yardpick.com/uploads/1/3/0/6/130604798/d88a43ed.pdf
    • http://mirasolrehab.net/uploads/1/3/0/4/130483842/fepujedovinut.pdf
    • http://metalslitter.com/uploads/1/3/0/5/130589416/fedis.pdf
    • http://cuisineandspirits.com/uploads/1/3/0/5/130550655/87fd51.pdf
    • http://empressretreats.com/uploads/1/3/0/8/130814014/d8a5aa430.pdf
    • http://mrdoghk.com/uploads/1/3/0/5/130548070/084ea99538e135.pdf
    • http://suite420marketing.com/uploads/1/3/0/8/130814168/8490495.pdf
    • http://hapicos.com/uploads/1/3/0/8/130813934/3474456.pdf
    • http://74-123-78-145.mgwnet.com/uploads/1/3/0/6/130620708/130620708.html#ibps+po+aptitude+questions+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003047.bin
b7ca808f4740874993041980e466b57b1218512edf9ad432e0d3b5b5ab684b24		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3047 8108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.