Malicious PDF — malware analysis report

Static analysis result for SHA-256 4fde0ebb1d959912…

MALICIOUS

PDF

64.0 KB Created: 2021-03-19 18:08:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 99b6bcebc2849304cd260568d6e1ea52 SHA-1: 689500805338c939a33193b4a3be1c06f3ce053f SHA-256: 4fde0ebb1d95991237f1d4d7117d7ac3a13e4962f17484f14bb99898e569a00d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, a common technique for SEO spam or to redirect users to malicious sites. The document body, though heavily obfuscated, contains references to 'Da vinci codex atlanticus pdf' and 'wkhtmltopdf', suggesting a lure. The presence of numerous unknown URLs further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6428

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=da+vinci+codex+atlanticus+pdf
    • http://fakts.design/873699060684w5ih.pdf
    • https://cdn.sqhk.co/dutaxato/VjaEhcT/disorder_synonyms_and_antonyms_dictionary.pdf
    • https://xusozetogiza.weebly.com/uploads/1/3/4/6/134620001/75bc09cff624573.pdf
    • https://cdn-cms.f-static.net/uploads/4403260/normal_6011f1cce2f30.pdf
    • https://zumaboletafu.weebly.com/uploads/1/3/1/4/131454272/2808d12e762.pdf
    • https://kaxawoxo.weebly.com/uploads/1/3/1/0/131070710/5957007.pdf
    • https://debuvubuni.weebly.com/uploads/1/3/4/8/134846467/1553804.pdf
    • http://topstop.site/xuritajutixulujipazukusana8l7a.pdf
    • https://cdn.sqhk.co/xuxawexa/jjK5Bhh/moto_racing_mod_apk.pdf
    • https://cdn.sqhk.co/sileluzorupo/dhahc8A/female_mannequin_dress_form_torso_dressmaker_stand_display.pdf
    • https://static.s123-cdn-static.com/uploads/4409246/normal_5ffc025d0f25b.pdf
    • https://uploads.strikinglycdn.com/files/fafb03c9-8903-4368-87d4-e37faafb7707/kovabaratosedegipi.pdf
    • https://uploads.strikinglycdn.com/files/965bac1a-4619-436c-a2ad-7e9d0842c4f9/kegadabagutawokegijipu.pdf
    • https://uploads.strikinglycdn.com/files/46d2f994-d7fe-49a7-ae27-80694bad31f6/is_the_acer_chromebook_14_good_for_gaming.pdf
    • https://uploads.strikinglycdn.com/files/40db7a2d-3c53-4500-8098-89cc120ed46e/tojarovupivujajevax.pdf
    • https://uploads.strikinglycdn.com/files/beb7d01d-2b27-4831-bbcc-4ba69f59a79c/how_to_set_up_interval_training_on_map_my_run.pdf
    • https://uploads.strikinglycdn.com/files/151fcea7-254b-44ea-8be3-be2786e0caed/is_cyberpunk_worth_it_on_series_x.pdf
    • https://uploads.strikinglycdn.com/files/3184b846-da33-4672-9fbe-b78a1fd69370/human_computer_interaction_job_prospects.pdf
    • https://uploads.strikinglycdn.com/files/9c369ae9-5c6b-4ef2-b4e3-21d175bcba5b/persona_4_golden_nanako_social_link_guide.pdf
    • https://uploads.strikinglycdn.com/files/a01b6183-392e-4898-b630-41c7095e6163/wafem.pdf
    • https://uploads.strikinglycdn.com/files/60cbe57b-37b4-42f6-9e8f-d43a87841467/why_wont_my_spectrum_remote_change_channels.pdf