Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a557d723fb2389a…

MALICIOUS

PDF

30.6 KB Created: 2020-04-15 09:12:19 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e620d7aabbf0972fb0e7ad8f80ba510b SHA-1: ea061f97252c260b9c8c10e33418ff4834f3f4ee SHA-256: 2a557d723fb2389affcf5c21e673de78a2b902c25ef4c8423e5a43b9abd4c19a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to other PDF files on different domains. This is indicative of a link farm or SEO poisoning attack. The primary external URI points to an HTML file, suggesting a redirection to a malicious site. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the exact lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9949

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://changleetkdallen.com/uploads/1/3/1/4/131406741/131406741.html#wifi+ac+usb+android
    • http://paulsmusicacademy.com/uploads/1/3/0/6/130639258/9813871.pdf
    • http://movementleadership.org/uploads/1/3/0/6/130604187/7770156.pdf
    • http://newthoughtmanifesting.com/uploads/1/3/0/4/130483445/nuwoludolibuwobu.pdf
    • http://nhalmon.com/uploads/1/3/0/6/130605230/sixinavetepo.pdf
    • http://apexexoticsbengals.com/uploads/1/3/1/3/131398101/06c31d.pdf
    • http://manetaspark.net/uploads/1/3/0/5/130550665/c3d014157.pdf
    • http://yvettewjones.com/uploads/1/3/0/2/130289386/sebewobarasopo.pdf
    • http://oandpideas.com/uploads/1/3/1/4/131410009/5864423.pdf
    • http://maudfischer.com/uploads/1/3/1/4/131405951/zevevuzefisivu.pdf
    • http://jasongerstenkorn.org/uploads/1/3/0/2/130287428/4215885.pdf
    • http://kotchegnadance.com/uploads/1/3/1/3/131383820/mufugamadaruxuluse.pdf
    • http://tk-talks.com/uploads/1/3/0/5/130551249/xoxupokiz-pekerixozujezed-palajavoxubawa.pdf
    • http://bagelsfrombennymusical.com/uploads/1/3/0/9/130969316/751dea8ebd28a7a.pdf
    • http://gehringarchitecture.com/uploads/1/3/1/3/131397983/sifimu.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.