Malicious PDF — malware analysis report

Static analysis result for SHA-256 53f22f4cbdf35ca4…

MALICIOUS

PDF

39.5 KB Created: 2020-04-03 17:48:56 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 03a1649dcc97a90de62c9a74b6248a6a SHA-1: a61afbacd92785301ed57f2bd7b5af79a7da06f1 SHA-256: 53f22f4cbdf35ca4964ef07cd80d45cb1e3d64e4e3a430d08ee0d33ce34ced55
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which point to other PDF files hosted on similar domains. This pattern is indicative of a link farm or SEO poisoning technique designed to attract users searching for specific content, such as 'diary of a wimpy kid old school pdf free download'. The primary URL and numerous other extracted URLs likely serve as lures to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sachkiretkaur.com/uploads/1/3/0/9/130969707/130969707.html#diary+of+a+wimpy+kid+old+school+pdf+free+download
    • http://kaisahuhtaniemi.com/uploads/1/3/0/4/130483795/58a82e4e378.pdf
    • http://portermotors.com/uploads/1/3/0/8/130814177/5859321.pdf
    • http://galaxiesunited.net/uploads/1/3/0/2/130287318/ketuxaxe.pdf
    • http://entertempleavalon.com/uploads/1/3/0/2/130289313/07a5ef114.pdf
    • http://primeeditorial.com/uploads/1/3/0/5/130588987/bemene_fuveli.pdf
    • http://info-tech-pro.com/uploads/1/3/0/2/130270738/5f55845a600d.pdf
    • http://firstdelightphotography.com/uploads/1/3/0/7/130775822/b42f3e7b393eb0e.pdf
    • http://a1septicocala.com/uploads/1/3/0/8/130813606/9819789.pdf
    • http://goldheartpersians.com/uploads/1/3/0/4/130476389/ginedelabet-kuvew-xejifoxod.pdf
    • http://boekinbinding.nl/uploads/1/3/0/7/130776754/6471871.pdf
    • http://floorplaymore.com/uploads/1/3/0/8/130874077/vidirigen.pdf
    • http://melatonindreams.com/uploads/1/3/0/9/130969817/tepir-gaditenive-koguzedudot-rasav.pdf
    • http://chronicwellnessexperts.info/uploads/1/3/0/2/130288533/0fb172d3984.pdf
    • http://maineventvolley.com/uploads/1/3/0/8/130813800/bbc556816.pdf
    • http://localdiscoveries.net/uploads/1/3/0/7/130740458/cbc64f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000715c.bin
c55de067d7c43a101d92854f41cc856f64fbe2ca34aa8ac2a051e9375ef4383d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x715C 7956 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.