Malicious PDF — malware analysis report

Static analysis result for SHA-256 30503c0c433a3df5…

MALICIOUS

PDF

39.1 KB Created: 2020-03-20 10:45:34 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c02bafae9d063253243736baac14e568 SHA-1: f39d1e63a9ab618330b6d25701f96677a54f1f11 SHA-256: 30503c0c433a3df5a65d709fc02f620ffb02c73918ead49a03687f7c944df46b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ML classifier strongly indicated maliciousness. The document body contains garbled text and what appears to be a reference to 'Lincoln and guba 1985 citation', suggesting a lure or obfuscation. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://themurrellfund.org/uploads/1/3/0/7/130776405/130776405.html#lincoln+and+guba+1985+citation
    • http://mathprnt.net/uploads/1/3/0/2/130287972/1c681f36f1845.pdf
    • http://74-123-77-88.mgwnet.com/uploads/1/3/0/6/130639573/virideb.pdf
    • http://greensmoothies.eu/uploads/1/3/0/6/130621896/dutijize.pdf
    • http://mail.allstarentertainmentky.com/uploads/1/3/0/2/130291624/donura_fubuzim_lonosomuk_fuwid.pdf
    • http://mail.kinderschwimmen-luzern.ch/uploads/1/3/0/5/130546209/wadeludaku_poforojaderabuw_gurazepote.pdf
    • http://turnernco.com/uploads/1/3/0/6/130604653/ragokebuxeridel.pdf
    • http://www.simojuice.com/uploads/1/3/0/3/130323959/67bea3.pdf
    • http://liqourlawvt.net/uploads/1/3/0/5/130547924/junogokumax.pdf
    • http://www.luzysombrafotografia.com/uploads/1/3/0/8/130874134/dapabe.pdf
    • http://dreamweaver-surf.com/uploads/1/3/0/4/130488569/375705.pdf
    • http://www.domainesentiersfrontaliers.com/uploads/1/3/0/6/130621472/5079935.pdf
    • http://0-12-0-demo.octarinesec.com/uploads/1/3/0/6/130620951/80ffd6d116.pdf
    • http://ndp3.net/uploads/1/3/0/5/130543545/e5c0f7.pdf
    • http://pumpkinheadphotography.com/uploads/1/3/0/7/130776730/winiga.pdf
    • http://npcpasolutions.com/uploads/1/3/0/4/130483821/7775823.pdf
    • http://platonschool.org/uploads/1/3/0/5/130589222/4959130.pdf
    • http://camposinsuranceagency.com/uploads/1/3/0/6/130604723/ab9900c2c7.pdf
    • http://eventocidadao.com/uploads/1/3/0/5/130538866/kazawarom_nowagubona_sofed_jofekajanuz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006667.bin
131b204e2355f1c4f3c065e3616920755d8978d8aba99cf64441cdf124214381		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6667 8300 bytes
font_01_sfnt_off00008669.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8669 2600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.