Malicious PDF — malware analysis report

Static analysis result for SHA-256 3959b27e27ef292a…

MALICIOUS

PDF

100.8 KB Created: 2020-04-12 01:16:37 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a955b39d5db1489626162804454b4b22 SHA-1: 7fdcb0940df587cbd62a1e56262f5a410c2c1a72 SHA-256: 3959b27e27ef292a36fc939bd32c33908aa5f5dc508c86ed41f2b09010cc9d05
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which appear to be generated for SEO purposes, pointing to other PDF files. The heuristic 'PDF_SEO_LINK_FARM' indicates this is a link farm. The primary external URI points to a .html file, suggesting a lure to a webpage. The ML classifier strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://deborahsnider.com/uploads/1/3/0/5/130588769/130588769.html#derecho+ambiental+chileno+pdf
    • http://bloodandbone.com/uploads/1/3/1/4/131438128/xilufinud_kewepaxowo_fexitiv.pdf
    • http://bettyfoleyartquilts.com/uploads/1/3/0/2/130291556/e7031.pdf
    • http://michiganreflexology.com/uploads/1/3/0/4/130477249/3344162.pdf
    • http://lonewolftattoos.com/uploads/1/3/0/4/130483052/bizuxi.pdf
    • http://oombagaonline.com/uploads/1/3/0/4/130436190/mezufefo.pdf
    • http://tylerfites.com/uploads/1/3/0/5/130547078/nogekugusawemanilet.pdf
    • http://tlicioustreats.com/uploads/1/3/0/2/130287278/puref-tisuseni-fuduponudumube-tagekitajaba.pdf
    • http://borirepa.com/uploads/1/3/1/4/131436956/96eab58a5.pdf
    • http://learn-tarot.com/uploads/1/3/0/3/130323889/mamodemoleg.pdf
    • http://techitup.org/uploads/1/3/0/6/130639311/dimudeweja.pdf
    • http://youthnowfarm.ca/uploads/1/3/1/3/131378838/zewuk.pdf
    • http://der-lab.org/uploads/1/3/0/7/130775443/4d575bcd21.pdf
    • http://datafluxvoicevideodatasolutions.com/uploads/1/3/0/4/130476712/jexozajarotel_zepakuzejeme_zajumumemabajun_fisizemetuv.pdf
    • http://citizenimmigrant.com/uploads/1/3/0/6/130605291/4877012.pdf
    • http://online-personal-coach.nl/uploads/1/3/1/4/131437615/kadel_mogevu_riruwivixesubek.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000141f1.bin
abf5b15eb0528e089b700bfdc4856db7a40f3faf92ecb040a254f09da0dd1ff6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x141F1 1872 bytes
font_01_sfnt_off000149c0.bin
8732665ef35777f629a3592a2255bc0942bda6bf6389fbe93af5cefb74e7c6b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x149C0 10656 bytes
font_02_sfnt_off00016f0a.bin
e5ccfd3f99ebc43cdff36d9dbb23b893a35b61ae846029f319c9c4559a202207		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16F0A 16112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.