Malicious PDF — malware analysis report

Static analysis result for SHA-256 41212be34290badb…

MALICIOUS

PDF

45.7 KB Created: 2020-03-29 10:57:33 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9efd8921d3ed5bdd4e4db593475b6c80 SHA-1: f2cbd8c6af606bb8a0f11f7b68552400ca8146a2 SHA-256: 41212be34290badb1bf694ed68d0378a214e518360ca2cd0e6e04fb30e71d850
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary URL points to a page discussing economic and social trends, but the embedded links are likely part of a link farm or redirection scheme. The ML classifier strongly indicates maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sta-66-99-58-206.ladse.org/uploads/1/3/0/7/130776076/130776076.html#tendencias+actuales+en+la+economia+y+la+sociedad+en+mexico
    • http://dixielandkettlecorn.com/uploads/1/3/0/3/130323705/2809974.pdf
    • http://malmo2020.se/uploads/1/3/0/2/130288391/939781.pdf
    • http://www.jesus-my-savior.com/uploads/1/3/0/3/130313336/7f964.pdf
    • http://www.thejessicatech.com/uploads/1/3/0/4/130476216/7b23cae.pdf
    • http://jolynstest.com/uploads/1/3/0/7/130739986/zijedirerul_gipolevef_gipimexuke_zugeba.pdf
    • http://genresnews.com/uploads/1/3/0/8/130814526/2763051.pdf
    • http://cloughmarine.com/uploads/1/3/0/7/130739430/sepewit_xosop_bibobuzaten.pdf
    • http://baijialemadinglan.br3h.com/uploads/1/3/0/6/130605399/xaxoworutelid.pdf
    • http://jennyoakley.com/uploads/1/3/0/6/130621361/3820600.pdf
    • http://lovesomeglitter.com/uploads/1/3/0/8/130814342/4268ddf4448b.pdf
    • http://borntomassage.nyc/uploads/1/3/0/4/130475928/zuvagezud.pdf
    • http://kgcomputerlab.com/uploads/1/3/0/2/130271117/lolafetuwekaliz.pdf
    • http://airpoirtautoelectrics.com/uploads/1/3/0/7/130776518/884ea459db1fc35.pdf
    • http://www.kwayonline.com/uploads/1/3/0/7/130739919/salomuleve_nepikejapo.pdf
    • http://cantabileartsmanagement.com/uploads/1/3/0/9/130968968/wenomoxifiz.pdf
    • http://calipulmonaryrehabservices.com/uploads/1/3/0/5/130539825/7066865.pdf
    • http://lykkr.bpmtc.com/uploads/1/3/0/5/130541023/9582610.pdf
    • http://realestatenepa.com/uploads/1/3/0/5/130590321/palewukimunuxil-bokizabozoj-bofasomupebam-vanilejokenudo.pdf
    • http://srinurayu.com/uploads/1/3/0/5/130551639/meleziji_razini.pdf
    • http://yardwell.com/uploads/1/3/0/8/130874543/a0cdfa2d88e.pdf
    • http://rosebudvault.com/uploads/1/3/0/2/130288567/ravogilofusesex.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008572.bin
62256598a59be4d7493c958d784d39ce3ed69a7927745c9264895ccce0825d5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8572 9224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.