Malicious PDF — malware analysis report

Static analysis result for SHA-256 357d19472a4ff366…

MALICIOUS

PDF

17.9 KB Created: 2020-03-11 02:21:30 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 23821a6ca4e698b1cce4222d8b74471d SHA-1: 426b6a955261b5bc648679e2ad1d86e2d2ca0647 SHA-256: 357d19472a4ff366669a72bf696a11b3ede5ac64ad291203cd7d014b39e7ae3a
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF is identified as an image-only lure, typical for phishing campaigns. It contains numerous external links, with a prominent one pointing to 'http://kirtananandkaur.com/uploads/1/3/0/8/130814652/130814652.html#ca+cervix+figo+staging'. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of generated SEO links, suggesting an attempt to distribute malicious content across various domains. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 17 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kirtananandkaur.com/uploads/1/3/0/8/130814652/130814652.html#ca+cervix+figo+staging
    • http://musicadventure.net/uploads/1/3/0/6/130604449/navigug-fumok-funet.pdf
    • http://www.alyssahollandphoto.com/uploads/1/3/0/5/130538863/852ba8ef7bb.pdf
    • http://pureluxsalon.com/uploads/1/3/0/6/130604022/3279732.pdf
    • http://alaskashrimpbait.com/uploads/1/3/0/6/130620546/8361127.pdf
    • http://nuenlist-holzkunst.ch/uploads/1/3/0/6/130604733/rifaforegevifi.pdf
    • http://gingershouseofbeauty.com/uploads/1/3/0/7/130740493/9056851.pdf
    • http://petqr.com/uploads/1/3/0/6/130621850/felajobumexibomi.pdf
    • http://hostmaster.power2thewomb.com/uploads/1/3/0/4/130483848/tagupofugulisexi.pdf
    • http://ww.gilltalks.com/uploads/1/3/0/5/130539238/933626.pdf
    • http://techtator.org/uploads/1/3/0/6/130639583/refoboxazurit_mazimezaduxer_numarojake_bijowun.pdf
    • http://cfcps2020.ca/uploads/1/3/0/4/130483407/70ccc9.pdf
    • http://south40solar.com/uploads/1/3/0/5/130588899/891f68ac75b6.pdf
    • http://playingwithgod.org/uploads/1/3/0/7/130775199/riwuwinejop.pdf
    • http://mynirvani.com/uploads/1/3/0/2/130270967/9382619.pdf
    • http://phantaststaffing.com/uploads/1/3/0/5/130542775/bolelijepesasof.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.