Malicious PDF — malware analysis report

Static analysis result for SHA-256 43e18e0021d862d1…

MALICIOUS

PDF

36.7 KB Created: 2020-06-11 19:39:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0366eca2d9e01f43eae9d6792dc4c350 SHA-1: dea847925c9aaec8f017b836b4c2229c7f3047a0 SHA-256: 43e18e0021d862d150f9a83e89e30d7d017ee435f802e24de61ab9eb43e7f03a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1598 Gather Victim Identity Information T1204 User Execution

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary URL, http://seafoodfestivalgiveaways.com/uploads/1/3/0/8/130813827/130813827.html#easiest+way+to+lose+belly+fat+without+exercise, suggests a lure related to health or weight loss. The ML classifier also strongly indicated maliciousness. The document body contains a mix of garbled text and URLs, reinforcing the link farm activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seafoodfestivalgiveaways.com/uploads/1/3/0/8/130813827/130813827.html#easiest+way+to+lose+belly+fat+without+exercise
    • http://expressyourselfpreschool.com/uploads/1/3/1/6/131636575/9519e1.pdf
    • http://wildbandofmystics.com/uploads/1/3/1/4/131437438/biturala_tetike.pdf
    • http://hostmaster.midlandsmortgages.co.uk/uploads/1/3/0/2/130270763/zoganis_judafa_rugutitezesilo_pavotuwog.pdf
    • http://paulligginsart.org/uploads/1/3/2/3/132302941/jipadex.pdf
    • http://webdisk.bodycompletefitness.com/uploads/1/3/0/3/130313241/0cea74.pdf
    • http://knoxfieldnaturals.com/uploads/1/3/0/8/130873781/ee1bf1ef224e.pdf
    • http://hespera16.ovmakeup.com/uploads/1/3/0/2/130289270/6248096.pdf
    • http://peopleoftheworldunited.com/uploads/1/3/0/8/130874591/8806924.pdf
    • http://kmf2018.de/uploads/1/3/0/3/130323342/4663487.pdf
    • http://burlapnlacepartycompany.com/uploads/1/3/0/2/130289205/baxutog_jozonisalejek_bovovuzovaxaba.pdf
    • https://ziwuxujit.files.wordpress.com/2020/06/bumil.pdf
    • https://tamitiliredu.files.wordpress.com/2020/06/turuvipawosasu.pdf
    • https://vonemimul.files.wordpress.com/2020/06/97927655018.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064c7.bin
adfcde58cd874cdf72fff34eb3d154ad346eb18c7ed328e6ea683b069daa9d0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64C7 9996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.