Malicious PDF — malware analysis report

Static analysis result for SHA-256 278ba7ac1fbc22af…

MALICIOUS

PDF

40.4 KB Created: 2020-03-29 12:38:06 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9e1740cd4aa52d25dcd0367b421b4bc5 SHA-1: 510b1b6fec1b006267f0caad6f0636f91588863f SHA-256: 278ba7ac1fbc22afab0412cacafc06bbd91defac2a7c4beb6f22184926a57a4e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO spam tactic. The document body, though partially corrupted, contains religious text and metadata indicating it was generated by wkhtmltopdf, which is often used to create SEO-optimized PDFs. The primary intent appears to be driving traffic to these external sites, potentially for malicious purposes such as phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adsl-63-204-18-43.benefitplans.org/uploads/1/3/1/4/131438583/131438583.html#misterios+luminosos+del+rosario+catolico
    • http://teamforevernatural.com/uploads/1/3/0/9/130969470/numaj-dukujo-dajara.pdf
    • http://pairofjacks.net/uploads/1/3/0/5/130552016/952fd6563275.pdf
    • http://folkio.com/uploads/1/3/0/7/130775726/noluvinirexuzagozol.pdf
    • http://vegascashflows.com/uploads/1/3/1/3/131379730/5139214.pdf
    • http://villascotti.com/uploads/1/3/0/5/130539714/8845760.pdf
    • http://svconsultoriajuridica.com/uploads/1/3/0/6/130604014/lofizituvuzeba.pdf
    • http://powercouplesworkshop.com/uploads/1/3/0/8/130874325/24076.pdf
    • http://namahahealthcare.net/uploads/1/3/0/6/130621545/56b56e2.pdf
    • http://eracalculator.org/uploads/1/3/0/5/130588672/8b449cfe.pdf
    • http://normanbrickandmasonry.com/uploads/1/3/0/5/130590499/weruzuboxor.pdf
    • http://oraciontextual.com/uploads/1/3/0/2/130289448/c250842.pdf
    • http://counselingtechnology.info/uploads/1/3/0/6/130620297/5829691.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007154.bin
784469ab03cd037c6c6195e40793ae03650044b624585cc93c918239aefd0c0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7154 9492 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.