Malicious PDF — malware analysis report

Static analysis result for SHA-256 5236c1f0e5c54d31…

MALICIOUS

PDF

55.8 KB Created: 2020-03-27 06:54:35 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c45060c0858a53cec531163ba32af1cd SHA-1: 55ca61c673e7e0f83582c4699f67421dbfaa94c0 SHA-256: 5236c1f0e5c54d31d5b7119acb2ab26cbd4e923b067709e417b2378d612f202d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious File: Malicious PDF

The PDF file contains a large number of external links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm or SEO manipulation scheme, designed to drive traffic to potentially malicious or low-quality content. The document body, though partially corrupted, contains text related to educational theories, likely serving as a lure to disguise the malicious intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://daryeelhomecare.com/uploads/1/3/0/4/130489297/130489297.html#teorias+pedagogicas+contemporaneas+en+el+marco+del+nivel+medio+resumen
    • http://burntofferingsbbq.com/uploads/1/3/0/9/130969166/2659481.pdf
    • http://openspacecoworking.es/uploads/1/3/0/7/130738569/db8ca333f.pdf
    • http://lolofashions.com/uploads/1/3/0/6/130640218/jagemavakivilese.pdf
    • http://www.marcbowthorpeinsurance.com/uploads/1/3/0/7/130776102/ddf522bc01.pdf
    • http://nlightfitness.com/uploads/1/3/0/4/130476120/1636069.pdf
    • http://pittsburghorganicsrecycling.com/uploads/1/3/0/4/130435514/wabaxuwep.pdf
    • http://cpanel.fulfordwood.com/uploads/1/3/0/9/130969965/8dfbae665d0a.pdf
    • http://zenfeather.org/uploads/1/3/0/3/130313504/2258449.pdf
    • http://kickingunit.com/uploads/1/3/0/5/130550770/larogavojubi_vulikatewakuk_kegubesomi.pdf
    • http://stmargaretbiglake.com/uploads/1/3/0/7/130738949/95d4fa7d5113c51.pdf
    • http://esotericbuilders.com/uploads/1/3/0/4/130483276/timati.pdf
    • http://prfresearchparks.com/uploads/1/3/0/6/130620353/mosafirujiretegapomu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009920.bin
5dd3744d5dc6d61d0d02a1d6c95c71ff55b47393858d8fada1c4d4c8c7c569b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9920 9100 bytes
font_01_sfnt_off0000b9a4.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB9A4 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.