Malicious PDF — malware analysis report

Static analysis result for SHA-256 386790f0683eb8a2…

MALICIOUS

PDF

35.8 KB Created: 2020-03-20 04:26:51 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 03827a9186c0757c57e6f7219c1e9c39 SHA-1: c7e3454cbcdf35de836aa99cf2669aafd3891979 SHA-256: 386790f0683eb8a29e3860302f0d71e71c7586b5b4f9b85439ceb82716c34e00
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

This PDF document is designed as a lure, presenting itself as a "God of War 3 walkthrough" to entice users to click on embedded links. The heuristic firings indicate it's an image-only document with an action trigger, a common tactic for phishing. The numerous external PDF links, including the primary one to learnwithag.com, suggest a redirection to a malicious site. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 35 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://learnwithag.com/uploads/1/3/0/9/130969439/130969439.html#god+of+war+3+walkthrough+ps3
    • http://niche-holdings.com/uploads/1/3/0/6/130622110/246158.pdf
    • http://dougmcelroy.com/uploads/1/3/0/4/130488506/5cf2d922873.pdf
    • http://firsttimeinkenya.org/uploads/1/3/0/2/130289431/samijewuxuv.pdf
    • http://weldershare.com/uploads/1/3/0/2/130270894/lodamasadebuza.pdf
    • http://webmail.cornishswimacademy.com/uploads/1/3/0/5/130541137/rujugufefok-gixiluxasudobi-noxapa-zosifuzu.pdf
    • http://whiskysurvivor.com/uploads/1/3/0/4/130436362/3538905.pdf
    • http://mx.omega-properties.com/uploads/1/3/0/5/130539265/3972237.pdf
    • http://iaafri.org/uploads/1/3/0/6/130604361/a832c.pdf
    • http://thebirthofchrist.com/uploads/1/3/0/7/130739247/2923944.pdf
    • http://eastbayzerona.com/uploads/1/3/0/9/130968957/fdc925ddbd.pdf
    • http://dementiasolutions.co.uk/uploads/1/3/0/3/130313098/5517856.pdf
    • http://broke-guys-guide.com/uploads/1/3/0/4/130435590/6268813.pdf
    • http://eddieqspeaks.com/uploads/1/3/0/6/130621451/3323872.pdf
    • http://downsideups.com/uploads/1/3/0/3/130323097/weretasef-jatonokudozasu.pdf
    • http://www.theguidefor.me/uploads/1/3/0/7/130776555/lejiwu-sifixaziderer-liduwadipad-nalowutelisarit.pdf
    • http://goatplatform.com/uploads/1/3/0/2/130289801/wekoz-femepujaf-vageb-nitifibuluba.pdf
    • http://planetemobile.net/uploads/1/3/0/6/130620945/polujo-juxajadefime-zafokid.pdf
    • http://ratswithwings.net/uploads/1/3/0/4/130435755/bapuvaf.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.