Malicious PDF — malware analysis report

Static analysis result for SHA-256 56bbf0337f0ef125…

MALICIOUS

PDF

73.7 KB Created: 2020-03-29 13:47:04 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ad632aa1646424a8919a4cd485fa53d0 SHA-1: f5a7f68a5453f2fa74ee64a91158973a56da4250 SHA-256: 56bbf0337f0ef1259dcd43b0902b502ee4467ba4a0f4567ec7dc69b19b4bb909
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to malicious content. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-76-23.mgwnet.com/uploads/1/3/0/4/130477864/130477864.html#purpose+driven+church+summary+pdf
    • http://hibulli.com/uploads/1/3/0/5/130539097/1060257.pdf
    • http://eirthsoutdoorcare.com/uploads/1/3/0/5/130588543/67afc10.pdf
    • http://bobbimccurdyphotography.com/uploads/1/3/0/4/130489149/f4ca19.pdf
    • http://islandairvirtual.com/uploads/1/3/0/6/130621307/lodolonobosir.pdf
    • http://ebikevictoria.com/uploads/1/3/0/7/130740068/xisavev.pdf
    • http://fotostudiolw.com/uploads/1/3/1/0/131070597/5809483.pdf
    • http://udomyte-corporation.com/uploads/1/3/1/1/131164160/somoxazawotejajuz.pdf
    • http://20thestudio17.org/uploads/1/3/0/7/130775612/9732415.pdf
    • http://keithluker.com/uploads/1/3/0/7/130776743/barozojetuxafik-xoginetuvugodis-nopebeketakuk.pdf
    • http://wemakesoap.com/uploads/1/3/0/2/130288394/5a342fcebefb.pdf
    • http://merrinconstruction.com/uploads/1/3/1/3/131380842/3544046.pdf
    • http://thepersuademe.com/uploads/1/3/0/2/130289177/13851.pdf
    • http://scalaconcrete.com/uploads/1/3/0/7/130739291/7b0d23a57bb87.pdf
    • http://seniorlifestylesmarketing.com/uploads/1/3/0/6/130639632/0ffc8716293a.pdf
    • http://elith-solutions.com/uploads/1/3/0/4/130476050/d18ca.pdf
    • http://powerwashingofamerica.com/uploads/1/3/0/2/130271190/1499b9f0.pdf
    • http://tab-ia.com/uploads/1/3/0/7/130776500/1980665.pdf
    • http://dpihi.com/uploads/1/3/0/4/130488304/5411191.pdf
    • http://cortonaevent.com/uploads/1/3/0/4/130476185/2701170.pdf
    • http://dhwsyracusecoe.org/uploads/1/3/0/4/130488616/zalen.pdf
    • http://kinderprints.com/uploads/1/3/0/2/130291415/dekonarorig-lejuboju-nawezatod.pdf
    • http://paranormalinvestigation.net/uploads/1/3/0/2/130273776/6c20d24395a.pdf
    • http://bighousesscotborders.org/uploads/1/3/0/5/130545666/tiwiguwumu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f96b.bin
dea539e847bfb841615830c92f231ff9680e3d56ef19e11ae4cd6705c6612f2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF96B 8156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.