Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b87af76e054b8fa…

MALICIOUS

PDF

42.7 KB Created: 2020-03-29 21:17:33 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a76e4fc83a1cb0a6d672713ea226c9e5 SHA-1: ca2f697f6020910bd96e17dfd3c8dc182145d1b3 SHA-256: 7b87af76e054b8fa3c83fac7c3a5f373f5bfca243c792ab602b2a06d49d3e88d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a reference to a product review and the authoring application, suggesting a lure. The primary function appears to be directing users to a vast network of other PDF documents hosted on various domains, likely for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lists.accordionapocalypse.com/uploads/1/3/0/5/130590043/130590043.html#tc+helicon+voicetone+harmony-g+xt+vocal+effects+processor+review
    • http://sofiyacattery.nl/uploads/1/3/0/7/130776296/romegajapaberaf.pdf
    • http://juliehimes.com/uploads/1/3/0/9/130969079/dosizi_fevegoguxix_tafami.pdf
    • http://kristin-guttenberg.de/uploads/1/3/0/4/130483422/9ac54d350df.pdf
    • http://scripturecc.org/uploads/1/3/0/9/130969565/9968437.pdf
    • http://storyinalocket.net/uploads/1/3/0/6/130604694/6ea6bf1.pdf
    • http://thethinkingeffect.com/uploads/1/3/0/3/130323465/1546fb48a8cab8.pdf
    • http://aurawakening.com/uploads/1/3/1/0/131069869/kikuweroxalomuvumuvu.pdf
    • http://meltoriginalart.com/uploads/1/3/0/7/130739240/7390653.pdf
    • http://globalattractionproductions.com/uploads/1/3/1/3/131398368/nobosurubuninizijipo.pdf
    • http://theclementcanopysg.com/uploads/1/3/0/8/130813317/lapafazonafozup.pdf
    • http://independencebible.com/uploads/1/3/0/6/130604231/koluvefevu.pdf
    • http://siobhans.space/uploads/1/3/0/6/130621349/pivomipeso.pdf
    • http://paragonsolutionsselect.com/uploads/1/3/0/5/130588968/5027399.pdf
    • http://righthandpa.org/uploads/1/3/0/7/130776148/pemedekefixasubenu.pdf
    • http://paulcurryelectrics.com/uploads/1/3/0/3/130379067/voduxujix.pdf
    • http://teamtodun.com/uploads/1/3/0/2/130289340/sozokeme_pogozinunukifax.pdf
    • http://colorfulminds918.com/uploads/1/3/0/4/130489841/1702856.pdf
    • http://grupocanela.org/uploads/1/3/0/6/130603855/pedivifepe_wokotelilumewi_pikorusitezidir.pdf
    • http://elmcityme.com/uploads/1/3/0/4/130488483/5250196.pdf
    • http://shiftingloyalties.org/uploads/1/3/0/7/130775282/muxifa.pdf
    • http://clergytaxreturns.com/uploads/1/3/0/6/130620340/6367600.pdf
    • http://josweddingchic.com/uploads/1/3/0/4/130483299/zomumu_wirij_rasapewedo_bagelitab.pdf
    • http://wgdcnkk.com/uploads/1/3/1/3/131383384/1104292.pdf
    • http://www.calyculin.com/uploads/1/3/0/5/130589160/lowij-mujuxipajosiwif.pdf
    • http://wgdcnkk.com/uploads/1/3/1/3/131383
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007aad.bin
870879cd28c0d760378da950058ae2187c1416660e20eb4644a6c98f5cf6ee7e
pdf-font-stream PDF embedded font (sfnt) at offset 0x7AAD 8128 bytes