Malicious PDF — malware analysis report

Static analysis result for SHA-256 3af98d8244d37d8a…

MALICIOUS

PDF

40.0 KB Created: 2020-05-09 00:07:51 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b1cce302317fd81474b6f6ef8dc34264 SHA-1: fe4b7aa4f69655d52a8c0b43ca2384510bb0cfc3 SHA-256: 3af98d8244d37d8a1086d8a8797e12347115701d26d22f2c6a4495d6e0dc9c9d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ML classifier strongly flagged this PDF as malicious. The document body contains garbled text and a few URLs, reinforcing the link-farming nature of the document.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://londongermanband.com/uploads/1/3/0/2/130291783/130291783.html#acneiform+lesions+treatment
    • http://bmtredeemer.com/uploads/1/3/0/7/130775598/4964555.pdf
    • http://onlineadvice.com/uploads/1/3/0/4/130435598/kafute_kirupizaxotil_redexiwuw_ropijerigur.pdf
    • http://polrelectrical.com/uploads/1/3/1/4/131409090/fijomola.pdf
    • http://colorobstaclerush.eu/uploads/1/3/0/7/130739783/didabu_vurazoju_kebukugewa_mawepoxesejore.pdf
    • http://ruthcampbell-paintings.com/uploads/1/3/0/3/130313218/337624.pdf
    • http://crybabiescollinscreations.com/uploads/1/3/1/0/131071151/928b56.pdf
    • http://chrissdiaz.com/uploads/1/3/0/6/130620981/8dd68f04.pdf
    • http://nytsattui.com/uploads/1/3/1/4/131406564/3235754.pdf
    • http://diamondsupplements.com/uploads/1/3/1/3/131379047/majovopogoka.pdf
    • http://dabsdungeon.com/uploads/1/3/1/4/131437296/rilukumoxetudu.pdf
    • http://iecep-bataan.com/uploads/1/3/0/6/130604950/4043415.pdf
    • http://redsonora2021.org/uploads/1/3/1/6/131636941/tikef.pdf
    • http://plasticdiamonds.net/uploads/1/3/0/2/130273743/wojizisopixep.pdf
    • http://noconcon.org/uploads/1/3/0/7/130775653/7854363.pdf
    • http://buchscan.ch/uploads/1/3/0/4/130435902/sonogeji.pdf
    • http://primeamazon.org/uploads/1/3/1/3/131398024/8694163.pdf
    • http://lorisingleton.com/uploads/1/3/0/9/130969445/kaloxazilare_pazafevuputor_divoguzer.pdf
    • http://shoelacecoding.co/uploads/1/3/0/8/130874678/2400020.pdf
    • http://gretamarchesi.com/uploads/1/3/0/5/130551211/860d951fec1.pdf
    • http://magryaudiovisual.com/uploads/1/3/1/4/131407846/7526723.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000729b.bin
3054ae966f0eadca674458babad6a98fb4945f555dff662963477449c7ba1e59		 pdf-font-stream PDF embedded font (sfnt) at offset 0x729B 10140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.