Malicious PDF — malware analysis report

Static analysis result for SHA-256 494fc30489e6d38c…

MALICIOUS

PDF

43.0 KB Created: 2020-05-13 13:51:11 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: bab4c728c6fa0e8f2b9ffd7912fdbca4 SHA-1: e77ecbb87a94f048fa244744dfd42ec8fecff444 SHA-256: 494fc30489e6d38cba9ed426240f5f40d4a336fa0e9432097a57738a0d691e4d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO spam tactic. The document body, though partially corrupted, references 'Metal gear survive steam guide', indicating a lure to attract users to potentially malicious websites. The PDF_SEO_LINK_FARM heuristic firing confirms the presence of numerous external links, and the ML_NYX_PDF_MALICIOUS score indicates a high probability of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nofone.net/uploads/1/3/0/2/130289577/130289577.html#metal+gear+survive+steam+guide
    • http://iahsalon.com/uploads/1/3/0/4/130435588/7529958.pdf
    • http://sarahmarcum.com/uploads/1/3/0/5/130589391/6188013.pdf
    • http://1361salon.com/uploads/1/3/0/6/130620366/4753412.pdf
    • http://shiftintogreatnesstoday.com/uploads/1/3/0/7/130738555/1426517.pdf
    • http://pastellemoon.ca/uploads/1/3/1/0/131070938/fowediwumoz_pubose.pdf
    • http://wwwgippslandfibreglass.com/uploads/1/3/0/2/130271137/5167701.pdf
    • http://fortworthrotary.org/uploads/1/3/0/5/130540280/defezidowijidel_lejexoruzavon_pelid.pdf
    • http://ncfashionexpotakeover.com/uploads/1/3/1/4/131437770/2eb916611df391.pdf
    • http://813insurance.net/uploads/1/3/1/4/131438079/denedepiwefu_votat.pdf
    • http://justleafwell.com/uploads/1/3/1/8/131871622/kalipupomonaxekedud.pdf
    • http://shellyjohnsonchoong.com/uploads/1/3/0/3/130313494/bajiragu.pdf
    • http://martincaicedo.com/uploads/1/3/0/6/130620490/3705327.pdf
    • http://wengercollectorscorner.com/uploads/1/3/0/6/130620635/4174140.pdf
    • http://rallyraideng.com/uploads/1/3/0/9/130969483/tareluzego-rubezetumi.pdf
    • http://tjockofant.se/uploads/1/3/0/2/130272850/vegugupekevamanu.pdf
    • http://linakwon3.com/uploads/1/3/0/5/130543190/lofezudezigazese.pdf
    • http://akolehwellness.services/uploads/1/3/0/5/130588675/d5352782a.pdf
    • http://socialanxietydoc.com/uploads/1/3/0/8/130814830/a8b2d09ea.pdf
    • http://orakel.xyz/uploads/1/3/0/3/130313746/setebegifolaso_wawedodi_watofebu_dakikuwena.pdf
    • http://thepinkreef.com/uploads/1/3/0/6/130620168/8353863.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007d73.bin
572fe455d8305a6215c16547c95f5d56055d46b130bfd05c87827dc14caabc39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D73 10072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.