Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fb354216e15a5d1…

MALICIOUS

PDF

36.8 KB Created: 2020-03-25 01:57:30 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ae964916f4458d25dea8267e60c57097 SHA-1: 702e25d3ffb83c8b379c84b1b2504c5ee61cd43d SHA-256: 3fb354216e15a5d12e5ba98632fd7b11a7d28805d9cd23aede5c0fcf7cd370ab
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

This PDF file is identified as malicious by an ML classifier. It contains a link farm designed to lure users with search engine optimization tactics, presenting itself as a movie download. The primary URL, http://armorgrind.org/uploads/1/3/0/7/130738680/130738680.html#peter+pan+full+movie+in+hindi+dubbed+download, and numerous other PDF links suggest a distribution mechanism for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://armorgrind.org/uploads/1/3/0/7/130738680/130738680.html#peter+pan+full+movie+in+hindi+dubbed+download
    • http://txdetectives.com/uploads/1/3/0/5/130551177/d6e19f5.pdf
    • http://collinsphotography.org/uploads/1/3/0/4/130483265/2acfc0cb68ff5.pdf
    • http://tattle41.pleasingfood.com/uploads/1/3/0/7/130739459/838af717db5.pdf
    • http://nhindependentvoters.org/uploads/1/3/0/5/130550665/045847aa98cdf.pdf
    • http://brattleborofigureskatingclub.com/uploads/1/3/0/9/130969762/gudawaj-gotonexalimina-kepebatet.pdf
    • http://www.ionicpowersports.com/uploads/1/3/0/7/130776518/tozazo_nenenufi_widinakixa_tamudafufonag.pdf
    • http://www.thebestyou.xyz/uploads/1/3/0/5/130550723/e1b6ddd0a64a5.pdf
    • http://tuffnlitehockey.com/uploads/1/3/0/5/130539492/riwetibidiwi-dofiminozo.pdf
    • http://choctawcountyrp.org/uploads/1/3/0/6/130604723/e55e69ba13.pdf
    • http://christmassweaterday.com/uploads/1/3/0/5/130550915/rigesusopef-gesakofu.pdf
    • http://slimpshandyhobbies.com/uploads/1/3/0/6/130621903/kolokafube-bifafe-bonarinozerawo.pdf
    • http://photowoodcuts.com/uploads/1/3/1/1/131163935/junimawokasapa.pdf
    • http://root.godfrey-lee.org/uploads/1/3/0/2/130272250/7283232.pdf
    • http://ingegnariaconsultants.com/uploads/1/3/0/5/130538866/9c4f490e3cdd969.pdf
    • http://my-atoz.com/uploads/1/3/0/3/130379411/06bc191a9b6.pdf
    • http://themerryberry.org/uploads/1/3/0/5/130540645/vemufujufuvuma.pdf
    • http://vaquerojesucristo.com/uploads/1/3/0/4/130483799/bobupot.pdf
    • http://mtgrahams.com/uploads/1/3/0/7/130738894/jirajedojunet.pdf
    • http://74-123-77-176.mgwnet.com/uploads/1/3/0/8/130814387/3bc0ea42e874718.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065d0.bin
9d6c4a22a1f6086b99657a8570d4498f1bb5bb2f0c5710184e82c99f3b54884f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65D0 8212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.