Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c29f216a320fc28…

MALICIOUS

PDF

28.6 KB Created: 2020-04-03 09:19:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 0fe16294256e3f50ee10a2d32dfb8ae6 SHA-1: 47b6be8c6b1ecbe98653c3606e83af12d97cca13 SHA-256: 4c29f216a320fc28e4977c34e1f85e7cdc719192d24b2c749b950e1bdbf9d4b2
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document employs a link farm technique, embedding numerous external links to various domains. The primary lure appears to be the inclusion of a movie title in one of the URLs, likely to entice users to click. The ML classifier strongly indicated maliciousness, and the PDF structure suggests an attempt to manipulate search engine results or distribute malicious content through a large number of seemingly unrelated links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://goulburnbodyshop.com/uploads/1/3/0/6/130621110/130621110.html#bajrangi+bhaijaan+full+movie+hd+online+youtube
    • http://prescriptionfornutrition.com/uploads/1/3/0/9/130969553/4412557.pdf
    • http://sureshmenonphotography.com/uploads/1/3/0/4/130483457/8381131.pdf
    • http://ssperformanceskating.com/uploads/1/3/0/8/130813079/4141079.pdf
    • http://alliedfoodforum.org/uploads/1/3/0/7/130738974/rokosirevo_migadobokipob.pdf
    • http://philanimalrescue.org/uploads/1/3/0/4/130488252/bifegin.pdf
    • http://lahrenconsulting.com/uploads/1/3/0/4/130476720/zokaruwopaxijewarani.pdf
    • http://holisticonlineshop.com/uploads/1/3/0/5/130539238/f7ead8.pdf
    • http://bakhtinislistening.blog/uploads/1/3/0/3/130313123/ravop-kefasumutenep.pdf
    • http://mixtapeandidentity.com/uploads/1/3/0/2/130287493/lozefadolanepusus.pdf
    • http://surveilgroup.net/uploads/1/3/0/7/130740464/56897bd0ccc8fef.pdf
    • http://trianglerealestatelisting.com/uploads/1/3/1/0/131070382/digatadatinosar_vajize_kiwotokozinitux_viwivewalu.pdf
    • http://cleverk9sports.com/uploads/1/3/0/3/130323555/9d313cb1806.pdf
    • http://theboutiquelania.com/uploads/1/3/1/3/131383767/wogem.pdf
    • http://piii.ca/uploads/1/3/1/0/131070171/3b11bab4e27cc.pdf
    • http://raldas.com/uploads/1/3/0/5/130590665/e959726f52b0.pdf
    • http://ichta.net/uploads/1/3/0/6/130604152/rigawonaxogeka.pdf
    • http://ashael.com/uploads/1/3/0/2/130288507/6961769.pdf
    • http://quinnowen.com/uploads/1/3/0/7/130776883/vilaj-logokalote-bilokobiju-bexutebig.pdf
    • http://caddelite.ca/uploads/1/3/0/8/130813447/d93b3.pdf
    • http://rareforreal.com/uploads/1/3/0/3/130313196/ed39d28f53e96.pdf
    • http://consciouslygreen.com/uploads/1/3/1/3/131378774/8d383aac.pdf
    • http://rcmustangfb.com/uploads/1/3/0/6/130604769/a136065f97839.pdf
    • http://carlospowellfoundation.org/uploads/1/3/1/1/131163783/8910417.pdf
    • http://redmachinesounds.com/uploads/1/3/0/5/130551002/ketedimesupid-sugowuzuwoko.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.