Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d4ae2dc4bf1ccbe…

MALICIOUS

PDF

34.3 KB Created: 2020-05-20 14:47:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0c07e75661cef01b6537288f44ca7a9d SHA-1: abd0b69ba29480a779cc77aa3fd8e85893af5ea5 SHA-256: 0d4ae2dc4bf1ccbe5306982a54c286d2b7cabb6261ec6add50765ebb07dbb865
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, also contains URLs pointing to external resources. This suggests the primary purpose is to redirect users to a network of websites, likely for SEO manipulation or to serve further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://iamcouturequeen.com/uploads/1/3/1/3/131397964/131397964.html#simbolos+astrologicos+para+word+part
    • http://smashcancerfgc.com/uploads/1/3/0/8/130874097/384345.pdf
    • http://high-rail.org/uploads/1/3/0/3/130312983/fb6753498fbd.pdf
    • http://burdentransportation.net/uploads/1/3/0/7/130775364/zizipubigap.pdf
    • http://alloneministries.net/uploads/1/3/0/3/130379063/xokevuzuzope-milezisobavuwoz-javov-mojigebareg.pdf
    • http://alexmckamie.com/uploads/1/3/0/5/130588839/2906775.pdf
    • http://unconventionalhope.org/uploads/1/3/0/5/130588513/mulumeta_nerekenuto_sumasuzuteb_zafojuliru.pdf
    • http://lineonfacebook.com/uploads/1/3/1/4/131483197/ramavog.pdf
    • http://thegangstagoddess.com/uploads/1/3/0/8/130814680/negib-vedegob-lisunumo-jozafum.pdf
    • http://centralmooloolah.com/uploads/1/3/0/6/130603850/2780019.pdf
    • http://hopehealthacademy.net/uploads/1/3/0/6/130604803/337222bba6.pdf
    • http://mummaherbssoftplay.com/uploads/1/3/1/3/131381332/gazorekotak.pdf
    • http://mcs-lawyers.com/uploads/1/3/0/6/130620998/xijokujubozusulak.pdf
    • http://tneducatorsconnect.org/uploads/1/3/0/5/130539097/2577732.pdf
    • http://mjbrendering.com/uploads/1/3/1/1/131164524/2721330.pdf
    • http://korurecruitmentnz.com/uploads/1/3/0/6/130621167/0627941c8b50e.pdf
    • http://photovideoarts.co/uploads/1/3/0/5/130588625/6278614.pdf
    • http://yournextheadquarters.com/uploads/1/3/1/3/131382531/pabipewidodikir.pdf
    • http://winstonoptical.com/uploads/1/3/0/4/130435701/4c81ce881.pdf
    • http://tryridecertain.com/uploads/1/3/0/6/130605368/1748413.pdf
    • http://anthemuas.com/uploads/1/3/0/6/130621654/7034796.pdf
    • http://thisgiftedlife.com/uploads/1/3/1/4/131453352/ralagufifekuzubavaz.pdf
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007651.bin
22e85746eefe1866d4b51e8bb45401ce7bbf161aed86a66a22273eade810dd69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7651 6908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.