Malicious PDF — malware analysis report

Static analysis result for SHA-256 48bd3f4a53150d35…

MALICIOUS

PDF

32.2 KB Created: 2020-05-14 17:51:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc62beddc74237471726240c7abde746 SHA-1: 12e6479d6212ac08c9a4fa8c31c2373af5826b02 SHA-256: 48bd3f4a53150d35345c8fdc8a6828f600d1fd27c0a7f3e9c6eee935e4e5c824
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous external links, a common tactic for SEO spam and phishing. The document body, though heavily obfuscated, contains text related to 'loan repayment schedule' and the authoring application 'wkhtmltopdf', suggesting a lure to a malicious website. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates a malicious intent to generate traffic or distribute further payloads through a network of linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sexpositiveboston.club/uploads/1/3/0/5/130590461/130590461.html#loan+repayment+schedule+excel+format
    • http://sheriahlangevents.com/uploads/1/3/0/5/130543166/viwage-ganuditam-pabuwumasiro-xodutunufexefi.pdf
    • http://zoeysheart.com/uploads/1/3/0/4/130489898/zarejotixeku_falineti_nirawatobo_zakugujimuburo.pdf
    • http://nourishandflow.com/uploads/1/3/0/3/130313155/xoneg.pdf
    • http://sydneyhandsurgeon.com/uploads/1/3/1/4/131453630/4798780.pdf
    • http://kokasi.org/uploads/1/3/1/4/131453637/d572b80ebd0ea50.pdf
    • http://snout.blog/uploads/1/3/0/6/130604359/8572643.pdf
    • http://biblewordstudy.org/uploads/1/3/1/4/131408092/2026799.pdf
    • http://megowerbung.com/uploads/1/3/0/9/130969422/xolilaw_labadotijapafej.pdf
    • http://desertjack.us/uploads/1/3/0/4/130436494/dilosipopegak.pdf
    • http://sclassinc.com/uploads/1/3/0/6/130621918/bigokurex_muzitozuguxuz_bivas_junefemuwikelul.pdf
    • http://wallaroosport.com/uploads/1/3/0/6/130621583/9397653.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005375.bin
3bb6980893d9543c5edc05b93ef8b353f8887a146b45160160467c39500a3341		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5375 10052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.