Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d60e742b213e253…

MALICIOUS

PDF

32.6 KB Created: 2020-04-25 04:38:54 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1e4ec0af7a714d2a79c1389e69bdbd27 SHA-1: c1ee189eabde60cfd752a7b87bec42dd51df2b16 SHA-256: 5d60e742b213e253cfb33eca8546e206cdae02843b7c82552b2b6c8641d06e96
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous external links, a common tactic for link farms or phishing campaigns. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, suggesting a coordinated effort to direct users to potentially malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8469

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aaronrentalproperties.com/uploads/1/3/0/6/130603904/130603904.html#adjectives+and+adverbs+practice+pdf
    • http://stephaniesabin.com/uploads/1/3/0/5/130551245/gejokiwumotiluj.pdf
    • http://futurereadytoday.org/uploads/1/3/0/4/130491444/lonuwerijupux_vazegev.pdf
    • http://lindensteamacademy.com/uploads/1/3/0/5/130588297/rasuxo.pdf
    • http://residencialnovotempo.net/uploads/1/3/0/9/130969678/564c2ff3538.pdf
    • http://djandthegreenleas.net/uploads/1/3/1/3/131398117/00cdc7d.pdf
    • http://scentneutrality.com/uploads/1/3/0/2/130271061/jerosadufogawogu.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.