Malicious PDF — malware analysis report

Static analysis result for SHA-256 039963893c6a175a…

MALICIOUS

PDF

22.0 KB Created: 2020-05-17 21:17:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5d50fb7c484a7d8b80fe493dde196cbf SHA-1: ba88fb313a70d8924ac4f8ea0cde86f9881f56f8 SHA-256: 039963893c6a175ab771c754a115017b350bd647ef73ba4a11522e0cafb21ab6
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a malicious screenshot lure, containing numerous external links. The document body is heavily obfuscated but contains references to Windows 7 and a URL that likely serves as the initial landing page. The presence of a large number of generated SEO links suggests an attempt to distribute malicious content widely.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 21 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://94veinte.com/uploads/1/3/0/4/130491319/130491319.html#cd+siz+format+atma+windows+7
    • http://machineintelligencelab.org/uploads/1/3/1/4/131453171/2e154d.pdf
    • http://scavengertours.com/uploads/1/3/0/2/130291624/1429867.pdf
    • http://themedicalscienceeditor.net/uploads/1/3/0/3/130379173/tulasavivejij.pdf
    • http://knoxypsummit.com/uploads/1/3/0/6/130639710/pujezeno.pdf
    • http://allthingsballet.com/uploads/1/3/0/5/130539131/8578307.pdf
    • http://mosaixcubed.com/uploads/1/3/1/0/131070646/sidab-juxiliz-defiraji-dasop.pdf
    • http://happywaytrucking.com/uploads/1/3/1/4/131437476/fofedanolipojubax.pdf
    • http://ienchantify.store/uploads/1/3/0/7/130776854/fotufoja.pdf
    • http://drivenbrand.com/uploads/1/3/0/6/130621052/belegovagugero_duvifowodufa_xagoxatozufot.pdf
    • http://visualimpactlandscaping.com/uploads/1/3/1/4/131454207/wapada-xofibexari-dojapi-fimez.pdf
    • http://bierrecensies.nl/uploads/1/3/0/7/130776801/8937511.pdf
    • http://rongchannel.com/uploads/1/3/1/4/131453682/javunamikafa.pdf
    • http://platinumprosports.com/uploads/1/3/1/3/131380470/50ce8ab6fd2d5.pdf
    • http://actionwipes.ca/uploads/1/3/0/4/130483114/2a60483e94.pdf
    • http://annarosebongiovanni.com/uploads/1/3/0/7/130740191/ae81f5495.pdf
    • http://hthmconsulting.com/uploads/1/3/0/4/130483457/jurifujexa.pdf
    • http://goalus.org/uploads/1/3/0/3/130323403/9336265.pdf
    • http://christophercorvo.com/uploads/1/3/0/6/130639291/vitorita.pdf
    • http://silverribboncrafts.com/uploads/1/3/1/3/131381045/xedegobema.pdf
    • http://beautifulyouartistry.net/uploads/1/3/1/0/131070753/1670758.pdf
    • http://malenyretreat.com/uploads/1/3/0/5/130540477/kegobemiwisesefav.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.