Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ec4edb3da864d20…

MALICIOUS

PDF

127.3 KB Created: 2020-03-21 20:46:15 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ac5f88f1d190f10f5c2ae0872fdc2169 SHA-1: 922d9191557a38ce0792f9fe7fe7cffa3e61679d SHA-256: 4ec4edb3da864d2049bf65d5628e791c67297a47950a27cdf83b860f4a15f5d1
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The document body's title suggests a lure related to computer science topics. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://avidaenglish.com/uploads/1/3/0/4/130483573/130483573.html#introduccion+a+los+algoritmos+thomas+cormen+espa%C3%B1ol
    • http://youngvoicesofislam.com/uploads/1/3/0/6/130604470/viwufur-mufaz-xevimafedatil.pdf
    • http://adsl-65-43-110-210.carmichaelnl.com/uploads/1/3/0/6/130621444/rawikiri-nogejadi.pdf
    • http://autodiscover.dcachurch.net/uploads/1/3/0/4/130488968/4756734.pdf
    • http://travelinaround.net/uploads/1/3/0/4/130435941/ab16bc23c.pdf
    • http://dynamiccorestrategies.com/uploads/1/3/0/5/130543476/1014524.pdf
    • http://mx.pescaturismotarifa.com/uploads/1/3/0/2/130289418/sovinidapuzu.pdf
    • http://miraculousmedicalmarijuana.com/uploads/1/3/0/3/130379060/6693414.pdf
    • http://abicreferrals360.agency/uploads/1/3/0/7/130776866/kajer.pdf
    • http://gmgwolverinerun.com/uploads/1/3/0/5/130540293/gawesaputitop_funazuw.pdf
    • http://serviziaeroportualisas.it/uploads/1/3/1/0/131070198/7571606.pdf
    • http://lifeinprinceton.com/uploads/1/3/0/6/130604129/5487054.pdf
    • http://matthewhirschfeld.com/uploads/1/3/0/6/130604582/fujijo.pdf
    • http://thankyousomech.com/uploads/1/3/0/2/130289158/4689756.pdf
    • http://www.login.superiormanor.com/uploads/1/3/0/5/130547659/fudegapobupil-gemolovumod-sejofef.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001bcf1.bin
ecebb63a0545a33843d682a904cf9a13b22d8e1c195abb9efe959a829f43f1c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BCF1 10376 bytes
font_01_sfnt_off0001e1c2.bin
54d41b2098d5b730dfe5cae5f637595b5c28c0fa6f902d2b9b0a03fac37f34be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E1C2 2848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.