Malicious PDF — malware analysis report

Static analysis result for SHA-256 20c7eaecda1b912e…

MALICIOUS

PDF

23.6 KB Created: 2020-04-13 02:44:06 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b4d560f020a87536cbb374541c19a6f2 SHA-1: 10ef663ce1865b12d917ad6e52d5136f6ed98b63 SHA-256: 20c7eaecda1b912ef369b71acfd7d145b6af8bf5fcfdeca45e10531cb2b4e6d3
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF file was identified as malicious by an ML classifier. It contains a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. The document body is heavily obfuscated but contains references to the URLs, suggesting a link farm or redirection strategy. No scripts were extracted, and the primary malicious activity appears to be the distribution of links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9944

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://davenportishome.com/uploads/1/3/0/8/130813999/130813999.html#formalidad+quimica+pdf
    • http://grandlodgegoldenroof.com/uploads/1/3/0/2/130270762/vetinojopadupebaxiz.pdf
    • http://graziesretreat.com/uploads/1/3/0/7/130775606/wagizup.pdf
    • http://physiochannel.net/uploads/1/3/0/6/130639117/vasaruzuzopuponu.pdf
    • http://thebeachhouseproject.com/uploads/1/3/0/9/130969587/7347697.pdf
    • http://charlesrousetattoos.com/uploads/1/3/0/3/130379285/vakerusolulun_pufogokulewir_ravedokurub.pdf
    • http://mhmpire.com/uploads/1/3/0/2/130274338/1323236.pdf
    • http://encountered.tv/uploads/1/3/1/3/131384636/pewow.pdf
    • http://ricemachining.com/uploads/1/3/1/4/131452771/18028983cba35.pdf
    • http://clunealnerve.com/uploads/1/3/0/3/130323479/9c73bfb2f72b9d.pdf
    • http://healthcoachingwithtara.com/uploads/1/3/0/7/130740547/6873046.pdf
    • http://obpassociation.com/uploads/1/3/1/4/131453967/1748eea6a72a8.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.