Malicious PDF — malware analysis report

Static analysis result for SHA-256 37efc2eac2a6086d…

MALICIOUS

PDF

39.8 KB Created: 2020-04-01 17:04:18 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a5e28f4fd3d590eb579e4e02507ee972 SHA-1: 75c2d6dd8c63d74336333172001b28384b3a7d96 SHA-256: 37efc2eac2a6086d0bd5ed88a47ed375d26aae85eb71d5cda93f6a3d6dbeb504
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, many of which follow a pattern indicative of SEO spam or link farming. The document body, though partially corrupted, suggests a lure related to 'solve equations with rational coefficients worksheet answers'. The primary heuristic, PDF_SEO_LINK_FARM, strongly indicates a malicious intent to drive traffic to a network of related domains. No scripts were extracted, limiting the analysis of direct payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://metrixvision.net/uploads/1/3/1/3/131384156/131384156.html#solve+equations+with+rational+coefficients+worksheet+answers
    • http://chocolateconcept.net/uploads/1/3/0/5/130589199/kegalo-wokovawoda-noviz-visiwugu.pdf
    • http://randomchorus.com/uploads/1/3/0/5/130551231/nibuxafibe.pdf
    • http://dottfulcoidebrandochirurgiadellamano.com/uploads/1/3/0/5/130539102/2415f0b8.pdf
    • http://katieschaefer.org/uploads/1/3/0/6/130621148/bf43bdb1bfb.pdf
    • http://myonecoast.com/uploads/1/3/0/5/130552034/68ee051f2e.pdf
    • http://lillelundshandvaerk.com/uploads/1/3/0/4/130483603/3740398.pdf
    • http://healthybodybygod.com/uploads/1/3/0/6/130604225/6d3670b9bf4.pdf
    • http://deadguycottoncandy.com/uploads/1/3/0/7/130775776/1243515.pdf
    • http://privetst.com/uploads/1/3/0/3/130313411/7361c.pdf
    • http://blackmagicchimneysweepent.com/uploads/1/3/1/1/131164122/nirerivifebomakutune.pdf
    • http://feelzapparels.com/uploads/1/3/0/6/130605017/2747487.pdf
    • http://drrachelgronke.com/uploads/1/3/0/5/130539247/c7aec055c93a.pdf
    • http://genevievedreizen.com/uploads/1/3/1/4/131406544/a84a242e36f.pdf
    • http://cardcountingmadeeasy.com/uploads/1/3/0/2/130289063/vulaviwifol.pdf
    • http://worldconstructionmechanical.com/uploads/1/3/0/7/130775011/163a323326db3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000727e.bin
092e05415062a481bd9ba50e926435d44887700078fb0d1105c1bff66d488e2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x727E 7928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.