Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e3aeb23f6872082…

MALICIOUS

PDF

35.3 KB Created: 2020-04-10 03:01:24 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 02d45914c4048f814d6baaf438b1ea32 SHA-1: 234602dc57a439f74315c1eb344dd1606362f520 SHA-256: 2e3aeb23f6872082a22607c51f002b62ecc5c7e6f62b168bc7ac76983e0fbcde
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file contains a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to malicious websites. The ML classifier strongly indicated maliciousness. The document body, though containing garbled text, includes a URL that appears to be a lure for a programming tutorial, likely a pretext to disguise the malicious intent of the embedded links. The primary attack pattern involves leveraging these links to direct users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://johnnyportercandle.com/uploads/1/3/0/4/130483457/130483457.html#programa+para+calcular+el+area+de+un+cuadrado+en+pseint
    • http://toykingdom.org/uploads/1/3/0/6/130639956/2710889.pdf
    • http://23percentclothes.com/uploads/1/3/0/3/130312968/af9634286274f5e.pdf
    • http://namjim.com/uploads/1/3/0/7/130738705/boxob.pdf
    • http://mycashflowmentor.com/uploads/1/3/1/4/131437779/xojarudiwuz.pdf
    • http://lillyclinickiev.com/uploads/1/3/1/4/131406762/2706424.pdf
    • http://cowboyentrepreneur.net/uploads/1/3/0/6/130621003/970b0a3d1a62ab4.pdf
    • http://oliverhox.de/uploads/1/3/1/3/131383523/sexesilolitizi-vawebob-bobilawawoditu.pdf
    • http://sh-equestrian.com/uploads/1/3/0/3/130379298/2339947.pdf
    • http://mayovanhire.com/uploads/1/3/0/6/130639840/2974970.pdf
    • http://2ndnaturenashville.com/uploads/1/3/0/7/130775138/dowuxuxibewevuvewa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f11.bin
f1eedd12ee40f8586ba518b2644ff1618b1f9f0163939e71f0624a40f15cf0e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F11 8484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.