Malicious PDF — malware analysis report

Static analysis result for SHA-256 380fca4cbe245cff…

MALICIOUS

PDF

37.8 KB Created: 2020-03-22 07:32:46 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: aaf0cdebdc91feb87b5f6c4e743620a0 SHA-1: 00f404f2ef7b3a6d5791efcbd20290eff446e72a SHA-256: 380fca4cbe245cfff70ef4bee661e22d0dd1e4a9f99cfb9cb2e419b39c7ae80d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains numerous links to external PDF files, a technique often used for SEO poisoning or to host malicious content. The document body mentions a 'Samsung se-506bb/tsbd firmware update', suggesting a lure to trick users into downloading potentially malicious firmware. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rapidrinsempw.com/uploads/1/3/0/5/130541004/130541004.html#samsung+se-506bb%2Ftsbd+firmware+update
    • http://cafformation.com/uploads/1/3/0/6/130603753/328949a.pdf
    • http://abullfrogstudio.com/uploads/1/3/0/5/130543106/654997.pdf
    • http://egydairy.com/uploads/1/3/0/4/130435895/05f1401.pdf
    • http://alniyatbellydance.com/uploads/1/3/0/4/130483184/2166512.pdf
    • http://smartbuytrader.com/uploads/1/3/0/6/130604168/7298259.pdf
    • http://csgocave.net/uploads/1/3/0/2/130288864/soxefalegizepop_kegizirekumuto_rilokeg_nejuga.pdf
    • http://randyslounge.com/uploads/1/3/0/4/130435503/konixap_tivar_nabesuz.pdf
    • http://insurancewebsitedesign.net/uploads/1/3/0/5/130590682/1896521.pdf
    • http://thestrategicbutterfly.com/uploads/1/3/0/6/130621075/575690fe5c28de.pdf
    • http://www.aleisyaaz.com/uploads/1/3/0/9/130969899/6339a7a9.pdf
    • http://ladyboner.net/uploads/1/3/0/5/130550949/baf43f.pdf
    • http://danscentrumnorr.com/uploads/1/3/0/2/130287988/52ab915c06.pdf
    • http://friendlyschoolcounselor.com/uploads/1/3/0/3/130379101/17f3a.pdf
    • http://www.warandpeacebuilding.com/uploads/1/3/0/5/130545382/2921817.pdf
    • http://mail.secrethillband.com/uploads/1/3/0/6/130620594/bd71076.pdf
    • http://distribuidoramario.net/uploads/1/3/0/4/130436513/ac572e2540.pdf
    • http://www.projectrohingya.com/uploads/1/3/0/3/130312950/f58249b579a42.pdf
    • http://thaitogether.org/uploads/1/3/0/7/130739891/3440097.pdf
    • http://sirsandboys.net/uploads/1/3/0/7/130740610/cbc332978c5f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c07.bin
8682a4a1595dae4bb51b8b9199b4cb2e1c23b2d2102269e6efa13a8c81c48b84		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C07 7596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.