Malicious PDF — malware analysis report

Static analysis result for SHA-256 75c21312f3c5344c…

MALICIOUS

PDF

20.6 KB Created: 2020-05-15 09:10:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 00190b8687a07f89d65e5ecf5087a6f8 SHA-1: 650b0204dff208a0f75cbab7ae6d4cdd352daa97 SHA-256: 75c21312f3c5344c2cf152a50d23a1214ec617535cc9550b0d696efb9693c181
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by an ML classifier and contains a large number of external links, indicating a potential link farm or redirection to malicious sites. The document body, though partially corrupted, contains a URL that is also present in the list of extracted URLs. The primary purpose appears to be directing users to a network of websites, likely for SEO manipulation or to serve further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://leseffreyantes.com/uploads/1/3/0/5/130551728/130551728.html#startup+convertible+debt+term+sheet
    • http://southburycremation.com/uploads/1/3/0/2/130272395/siromaxifirevakapi.pdf
    • http://whiteroom48.com/uploads/1/3/1/4/131438604/veninojol.pdf
    • http://sistermissionaryprep.com/uploads/1/3/1/6/131636826/2d9a89e5e1.pdf
    • http://timmahekdds.com/uploads/1/3/0/5/130551922/fefelobanijijadivope.pdf
    • http://cuddlykoalaspreschool.org/uploads/1/3/0/5/130543383/rupemagapebe.pdf
    • http://elysseceleste.com/uploads/1/3/1/4/131453715/a4b4f820.pdf
    • http://dndentalplans.com/uploads/1/3/0/5/130550732/5776246.pdf
    • http://theroyaltywrx.com/uploads/1/3/0/4/130491703/88ad5673806.pdf
    • http://red-panda.pl/uploads/1/3/0/7/130776223/8410645.pdf
    • http://inserviceplus.com/uploads/1/3/0/6/130639712/kokutedopewivizug.pdf
    • http://anofficiantgirl.com/uploads/1/3/0/8/130874347/1712951.pdf
    • http://truhemphealth.net/uploads/1/3/1/3/131379538/taselaf.pdf
    • http://premierorthopediccenter.com/uploads/1/3/0/5/130588775/b2809eecac494d.pdf
    • http://groupctrl.club/uploads/1/3/0/6/130621182/naxibizujujareje.pdf
    • http://japanesespitznz.com/uploads/1/3/0/7/130775892/3428677.pdf
    • http://lesliematheos.com/uploads/1/3/0/6/130604263/sufas_rujuzipevedo.pdf
    • http://osquarepad.com/uploads/1/3/1/1/131164132/8960457.pdf
    • http://janenesmithvocalcoach.com/uploads/1/3/0/7/130739141/4812300.pdf
    • http://lincsepc.net/uploads/1/3/1/4/131437223/89ffe.pdf
    • http://allamericanhandyman.org/uploads/1/3/0/2/130288775/vujesogogaxofazapune.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.