Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d106d7e70bfc590…

MALICIOUS

PDF

41.1 KB Created: 2020-04-04 14:45:31 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a176850a5211ed5f419ac8a6a38a595b SHA-1: 435aaf8fe64809223705c887006a6de1b70d9eb6 SHA-256: 3d106d7e70bfc590d4ae380ff176ff3828fee5d7c77553fb9a99e37c52c1361c
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

This PDF file exhibits characteristics of a link farm, with a significant number of external URLs embedded within it. The primary heuristic, PDF_SEO_LINK_FARM, indicates a mass of external links, with 'purecoolio.com' being a dominant host. The ML classifier also strongly flagged this PDF as malicious. The embedded URLs likely lead to further malicious content or phishing pages, aiming to redirect the user away from the initial document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://heatherbiggsphotography.com/uploads/1/3/0/2/130271041/130271041.html#cuanto+mide+un+atomo+de+oxigeno+en+mm
    • http://purecoolio.com/uploads/1/3/0/7/130739264/kefejiwulakaleriz.pdf
    • http://claypancreas.com/uploads/1/3/0/6/130621648/xozofukanu.pdf
    • http://celisifiricel.com/uploads/1/3/0/6/130604028/nafejikifoxito.pdf
    • http://hattrickutilities.com/uploads/1/3/0/5/130551670/woxexun.pdf
    • http://milkandhoneyhealing.org/uploads/1/3/0/8/130814056/lozazesuni-zalafekelotolu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000767e.bin
1f98bb4a7e4232b96f3dff13cddb897d91e13c7406af138973000374cbbdb233		 pdf-font-stream PDF embedded font (sfnt) at offset 0x767E 8744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.