Malicious PDF — malware analysis report

Static analysis result for SHA-256 328d3bd8431abb64…

MALICIOUS

PDF

40.0 KB Created: 2020-04-03 06:24:59 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b64a4935977da048caf9ecb1e1498ec8 SHA-1: c2b86a85105e7593d45d95538859487677ed51fd SHA-256: 328d3bd8431abb6475830c02679724ea3f272f6e96b74b77580086cdfa404a43
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The document body contains a Spanish phrase related to input devices, which may be a lure. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gmbautocenter.com/uploads/1/3/0/7/130740218/130740218.html#cu%C3%A1l+es+la+funci%C3%B3n+de+los+dispositivos+de+entrada
    • http://zachpalmer24.com/uploads/1/3/0/3/130380002/28e38fefe4.pdf
    • http://jeffhighfootball.com/uploads/1/3/0/6/130604395/tebifixepexop.pdf
    • http://bournemouthmindfulness.net/uploads/1/3/0/5/130588304/ebf0ce6eb.pdf
    • http://metronashinspect.com/uploads/1/3/1/0/131070246/zixakomasewaxipume.pdf
    • http://sfscleaningservices.com/uploads/1/3/0/6/130621167/watefusalawin.pdf
    • http://repairguider.com/uploads/1/3/0/3/130379466/linemubegabeduk.pdf
    • http://victoriaghairdesign.com/uploads/1/3/0/3/130313038/809201.pdf
    • http://hellaherbaceous.com/uploads/1/3/0/2/130287505/futenurorisovax-jesenesux-wobobof.pdf
    • http://kmg-promotions.com/uploads/1/3/0/6/130621847/6db6ca6829ee429.pdf
    • http://irinaderbina.com/uploads/1/3/0/8/130874433/6645665.pdf
    • http://gottaluvthatbling.com/uploads/1/3/0/5/130540928/tewizugizuzazezadak.pdf
    • http://wesanne.com/uploads/1/3/0/9/130969245/gufajusafozerurimi.pdf
    • http://dybowski.ca/uploads/1/3/0/2/130273983/bfa615b97358.pdf
    • http://mtg.blue/uploads/1/3/0/7/130775734/rureganoruluvobi.pdf
    • http://texascrosstimbersranch.com/uploads/1/3/0/8/130874678/b767f78492c3d8.pdf
    • http://dynamicnutritionpro.com/uploads/1/3/0/3/130323962/2fe791946.pdf
    • http://vivadeeretreat.com/uploads/1/3/0/5/130551287/zetawuwozo-sisobubuk-sewademew-saguwenojuw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007038.bin
bd58f624bef08853727a450df44e7c546d8753fb9b9493caab9f60d0f4a3a736		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7038 8688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.