Malicious PDF — malware analysis report

Static analysis result for SHA-256 77cd8b85f911f2e7…

MALICIOUS

PDF

15.7 KB Created: 2020-05-20 16:22:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2336234679f84cb9624b6c54d5b91029 SHA-1: 4efb2e96a4e12b3a3a729c2c630e4a31d0815718 SHA-256: 77cd8b85f911f2e78f7904a72a08a12de66a88c728e6177d6d69a03d00853fa1
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document is identified as a malicious screenshot lure, designed to trick users into clicking embedded links. The document contains a large number of external PDF links, suggesting a link farm or redirection mechanism. The primary lure appears to be a link to 'http://simplydelicioussimplyfun.com/uploads/1/3/0/6/130620951/130620951.html#cva+bleeding+adalah+pdf', which likely leads to a phishing page or a further malware download. The ML classifier strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 15 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://simplydelicioussimplyfun.com/uploads/1/3/0/6/130620951/130620951.html#cva+bleeding+adalah+pdf
    • http://bfsf2020.net/uploads/1/3/0/7/130775747/ea0e51c9be2343.pdf
    • http://amarantepatrimoine.com/uploads/1/3/1/4/131452887/mirapafebipakosaru.pdf
    • http://junkremovalop.com/uploads/1/3/0/6/130604281/2140635.pdf
    • http://steamboattees.com/uploads/1/3/1/8/131856772/rifagumuxor.pdf
    • http://uccarticle9.net/uploads/1/3/0/6/130604324/a43708.pdf
    • http://frukosthem.com/uploads/1/3/0/9/130969614/xegiwawedi_jamaxule_jafetorebun_juputogapufagi.pdf
    • http://hbogarajets.com/uploads/1/3/1/6/131637806/a091adfe7a713.pdf
    • http://vr-authority.com/uploads/1/3/1/4/131437711/jewesox-vepibo-dadirolijef.pdf
    • http://photosandburritos.com/uploads/1/3/1/4/131438211/4638951.pdf
    • http://iltaddeo.com/uploads/1/3/1/4/131453892/e73e5.pdf
    • http://awesomeu.life/uploads/1/3/0/5/130588688/8018535.pdf
    • http://romboid.pl/uploads/1/3/1/3/131398373/e2abd3f058d6d6.pdf
    • http://idhealthylife.com/uploads/1/3/1/0/131071125/1806089.pdf
    • http://bethadice.com/uploads/1/3/0/8/130873846/rekexegaz_zuras_tujuset.pdf
    • http://chookshedstudio.com/uploads/1/3/1/3/131382583/jixebupomum_basedaza_ruvigosezowad_kolaz.pdf
    • http://ev-analyst.com/uploads/1/3/0/7/130775902/9bc225320415b9b.pdf
    • http://iloveyousti

Open this report in the interactive analyzer, or submit your own file for analysis.