Malicious PDF — malware analysis report

Static analysis result for SHA-256 322790fbdf14f753…

MALICIOUS

PDF

39.2 KB Created: 2020-03-11 02:12:04 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9960bbf90cd349a2611fb0bd68d2e832 SHA-1: 201e1c22196da3b73b851d4259e8d71fce065220 SHA-256: 322790fbdf14f75392ae4ca16ee9b5d7ea377834be3a6c893c9b72f6b1745c5d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files hosted on various domains. The primary lure appears to be 'wood boat plans free', suggesting a deceptive tactic to drive traffic to these linked resources. The ML classifier strongly indicates maliciousness, and the structure suggests a link farm designed to distribute further malicious content or conduct phishing. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-78-125.mgwnet.com/uploads/1/3/0/7/130776428/130776428.html#wood+boat+plans+free
    • http://as13.com/uploads/1/3/0/5/130545698/273830.pdf
    • http://younique-you.com/uploads/1/3/0/6/130621158/5af580887f.pdf
    • http://athletesinactionbaseball.com/uploads/1/3/0/5/130588173/694359.pdf
    • http://nyconcretefloors.com/uploads/1/3/0/8/130815059/2705580b.pdf
    • http://cannabinoidservices.com/uploads/1/3/0/7/130739098/komowavojawi_zemuzitawag_kivagupirufosat_jikup.pdf
    • http://trond.com/uploads/1/3/0/7/130740213/lemunitom_pevuwezoze_vukudatej.pdf
    • http://linknoise.com/uploads/1/3/0/3/130323794/214702.pdf
    • http://trustwisconsinwomen.org/uploads/1/3/0/2/130287866/dugamegata.pdf
    • http://phoneserver2012.pinnacleven.com/uploads/1/3/0/6/130621021/12b9ad.pdf
    • http://community-band.com/uploads/1/3/0/6/130603828/7719d47a55b8e.pdf
    • http://buytrazodone50mgonline.greatwebsitebuilder.com/uploads/1/3/0/9/130969407/4b9ecfb0f36a8b.pdf
    • http://thevelvetfarm.com/uploads/1/3/0/4/130478709/zesutotalifuwuj.pdf
    • http://www.jollielucks.co.nz/uploads/1/3/0/2/130271038/19087659b21a3.pdf
    • http://lingeriestoresdallas.net/uploads/1/3/0/7/130775866/83856f6b360606.pdf
    • http://numihomes.com/uploads/1/3/0/6/130603895/29b7b53a77ab8.pdf
    • http://iworkwithlistingagents.com/uploads/1/3/0/4/130476514/3b27ddf0.pdf
    • http://silver-linings-speechtherapy.com/uploads/1/3/0/6/130640163/zezena_lamukodajobi_lumewomaxexewix_misenogagavani.pdf
    • http://agirlfromodisha.com/uploads/1/3/0/5/130540937/3b17d2c6270ff.pdf
    • http://iamwillhsu.com/uploads/1/3/0/6/130605178/bagitopur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000722e.bin
04154bec53673392ba0732d8c86d410eaca55ff5a66c132a97d9b8794dfef677		 pdf-font-stream PDF embedded font (sfnt) at offset 0x722E 7544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.