Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f7fade8282cd329…

MALICIOUS

PDF

22.3 KB Created: 2020-04-01 19:06:12 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c48ea1ca0175e0cafea6a398ccfaef6d SHA-1: 7edc13625f3da99676f3b35267248c27dd2e05e6 SHA-256: 0f7fade8282cd32959fa7bb176f4a268117baa6a3f1903c6974d34d11f10d4ff
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was identified as malicious due to its structure, which includes a single image and minimal text, typical of a screenshot lure. It contains numerous external links, suggesting it's part of a link farm designed to redirect users to potentially malicious websites. The primary lure appears to be a document titled 'Versos cortos infantiles que rimen', which is likely a deceptive cover for the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 22 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fritsdecobel.com/uploads/1/3/0/5/130590123/130590123.html#versos+cortos+infantiles+que+rimen
    • http://cbncertifiedbossnetwork.com/uploads/1/3/0/6/130605475/fakawugijaxafo-xonimalaguv-tifizeloboko-nugudizate.pdf
    • http://danielstumekia.org/uploads/1/3/0/6/130621569/3317719.pdf
    • http://aplusmobilebraksaar.com/uploads/1/3/0/7/130775286/retifofomosegopopaf.pdf
    • http://generationmoxie.com/uploads/1/3/0/4/130477152/6222425.pdf
    • http://psymetralabsone.com/uploads/1/3/0/2/130289508/3df7b1d68b.pdf
    • http://abcseamlessofbemidji.com/uploads/1/3/0/8/130873804/sopumaxokibul_fixuxevakojavi.pdf
    • http://gofloridabiz.com/uploads/1/3/0/5/130589020/1073407.pdf
    • http://bdfpropertysolutionsma.com/uploads/1/3/0/7/130775424/3990771.pdf
    • http://soulcleaningservices.net/uploads/1/3/0/2/130289021/koxoduno.pdf
    • http://theultimatehumanpotential.com/uploads/1/3/0/6/130603985/kodunetiwunor.pdf
    • http://inkonbeeswax.com/uploads/1/3/0/7/130739470/negev_jawelu_gasere.pdf
    • http://dailycarolinadeals.com/uploads/1/3/0/4/130475966/37c7d338062bc0.pdf
    • http://uffctv.com/uploads/1/3/1/4/131437604/3106940.pdf
    • http://missmillersclassroom.com/uploads/1/3/0/5/130543019/funukuranolu.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.