Malicious PDF — malware analysis report

Static analysis result for SHA-256 3311f0471c39cad4…

MALICIOUS

PDF

38.7 KB Created: 2020-03-17 02:53:17 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b08ca2618f500b915737daf687562711 SHA-1: 1eab41f319195df126f28afe2b188ccb96dec937 SHA-256: 3311f0471c39cad46ea2d187246f1d79926f88cf0c654671dfb23abcc9d1ca4b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body contains text related to 'Guerra e paz livro completo' and includes multiple URLs, such as http://starrmark.net/uploads/1/3/0/5/130588695/130588695.html#guerra+e+paz+livro+completo and http://kaylabrown.co/uploads/1/3/0/3/130313299/0dfdf.pdf. This suggests a link farm or SEO manipulation tactic, potentially leading to malicious content hosted on these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://starrmark.net/uploads/1/3/0/5/130588695/130588695.html#guerra+e+paz+livro+completo
    • http://kaylabrown.co/uploads/1/3/0/3/130313299/0dfdf.pdf
    • http://skynet247.com/uploads/1/3/0/6/130604810/dezope.pdf
    • http://www.firstclassclean.com.au/uploads/1/3/0/7/130775364/8481576.pdf
    • http://taobaoshuashoucangmianfeiruanjian.thesurge.cc/uploads/1/3/0/3/130379294/nipijixogoxipu-pisavaladulova-nibofeko-zekako.pdf
    • http://loveallbags.theplaidpurse.com/uploads/1/3/0/6/130604181/gewefegarunewewaduwe.pdf
    • http://lakepointe5.com/uploads/1/3/0/6/130639084/371d84266594b0.pdf
    • http://htrionline.org/uploads/1/3/0/5/130589252/8821521.pdf
    • http://vandenbossracing.com/uploads/1/3/0/6/130620594/tezoki.pdf
    • http://ministryops.net/uploads/1/3/0/4/130483249/6960104.pdf
    • http://www.cb15.org/uploads/1/3/0/6/130604148/65832.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067a1.bin
441eb6800e3e67efff7bc4346f970f3208eaf2def8a58fcb07fbfe48ca2eabd6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67A1 12424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.