Malicious PDF — malware analysis report

Static analysis result for SHA-256 2642aac630bb69e8…

MALICIOUS

PDF

43.6 KB Created: 2020-03-26 13:14:41 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ab739c2120fd548a5f41c11c3eb98b55 SHA-1: 93e005ef42ec6bba61273365bbcf47bf53bd701a SHA-256: 2642aac630bb69e816b76c97de964072bde4774e6ea2344364973953fdea2606
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of external links, many of which are structured as SEO-friendly URLs pointing to other PDF files. The document body text, though partially corrupted, includes the phrase 'Juliano el apostata libro pdf', suggesting a lure to download a book. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of a mass external PDF link farm, indicating a likely SEO spam or content redirection scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://randombutdope.com/uploads/1/3/0/8/130814030/130814030.html#juliano+el+apostata+libro+pdf
    • http://bethanylutherancushing.org/uploads/1/3/0/7/130739852/garisole_zepaxe_nupofozuze.pdf
    • http://fjmusique.com/uploads/1/3/0/9/130969976/6542725.pdf
    • http://rachelmariephotos.com/uploads/1/3/0/4/130483566/gowajakatav-tevatarepinoz-mimafabalupal.pdf
    • http://christiancattlecompany.com/uploads/1/3/0/7/130775476/zubelazibanoloridasa.pdf
    • http://usedversaspa.com/uploads/1/3/0/6/130639461/6376183.pdf
    • http://chestersgetaway.com/uploads/1/3/0/5/130539059/1b96ba96a846.pdf
    • http://lincolnbailbonds.net/uploads/1/3/0/2/130288932/6280535.pdf
    • http://letkurock.fi/uploads/1/3/0/6/130605462/xilamivo-pawosedikatel.pdf
    • http://henrymohrpta.org/uploads/1/3/0/7/130776001/3348171.pdf
    • http://henrybhill.com/uploads/1/3/0/5/130542872/gapol_lugefujubapivi_kosir_zifojetufe.pdf
    • http://hobbyinspirasjon.no/uploads/1/3/0/6/130604067/df22c1b9c5a.pdf
    • http://taocleaningbusinesses.com/uploads/1/3/0/2/130272930/kekukezutijexa-durifebu-molikukodajo-zisudanukolip.pdf
    • http://jennyrai.com/uploads/1/3/0/5/130590714/simoveni-getalogo.pdf
    • http://www.nouvolaviboutik.com/uploads/1/3/0/3/130313577/9ec4c0dd.pdf
    • http://geanecoach.com/uploads/1/3/0/8/130814056/7129582.pdf
    • http://buzzium.com/uploads/1/3/0/6/130603861/7822760.pdf
    • http://lalogodesigner.com/uploads/1/3/0/4/130483872/napuborexabi-fotuzoropube.pdf
    • http://infinityinstalls.com/uploads/1/3/0/2/130289386/jazusadedewuk-ruwun-pawela.pdf
    • http://rebeccacalisi.com/uploads/1/3/0/8/130814232/2203354.pdf
    • http://aroundthehousehandymanservices.com/uploads/1/3/0/5/130589416/4147189.pdf
    • http://myvirtueventure.com/uploads/1/3/0/5/130550949/2060548.pdf
    • http://5yearson.com/uploads/1/3/0/7/130738812/1027265.pdf
    • http://serenityrowe.com/uploads/1/3/0/5/130590436/dosizikofakuj.pdf
    • http://snowyawesome.com/uploads/1/3/0/3/130379254/xemav-fivepunomi.pdf
    • http://aerialinnovationsllc.net/uploads/1/3/0/5/130588477/c155dee6093.pdf
    • http://snowyawes
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007d45.bin
3fc44f6676dc0d0d5c8ed1578e3ebacc5c417a3c7283798f5330acc9384dff88		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D45 9132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.