Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bf32009e1476dff…

MALICIOUS

PDF

31.1 KB Created: 2020-06-01 18:55:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4000ccf01a5a7fed4fffa91ca9ed702e SHA-1: 8374ebc84d2a4ebd5c724cf1eec3400aab416c52 SHA-256: 7bf32009e1476dff370158740476af19962c1121e2c1496905d68b057b3a4d74
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded links to external websites, many of which are structured as PDF files with numeric slugs, indicating a potential link farm for SEO manipulation or malware distribution. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs suggests an attempt to redirect the user to potentially harmful content. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a malicious intent to redirect users to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.lifeoil.ba/uploads/1/3/1/3/131398313/131398313.html#triangle+semblable+exercice+corrig%25C3%25A9+3eme
    • http://fuckitdesigns.com/uploads/1/3/0/8/130874359/507924.pdf
    • http://activeairga.com/uploads/1/3/0/5/130588834/3478086.pdf
    • http://jandcconsultant.com/uploads/1/3/0/6/130621280/0b3fe19f3f.pdf
    • http://ebartnfurniture.com/uploads/1/3/0/8/130814168/321736.pdf
    • http://birminghamweddingsandevents.com/uploads/1/3/1/0/131071137/jajilum.pdf
    • http://mta-sts.lifeoil.ba/uploads/1/3/1/3/131398313/terms.html
    • http://mta-sts.lifeoil.ba/uploads/1/3/1/3/131398313/dmca.html
    • http://mta-sts.lifeoil.ba/uploads/1/3/1/3/131398313/policy.html
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://tanudatekaj.files.wordpress.com/2020/05/8038854011.pdf
    • https://jefofim.files.wordpress.com/2020/06/poriroluroxuwejukiraneji.pdf
    • https://pobukurimu.files.wordpress.com/2020/06/vabelegoba.pdf
    • https://zopowozofoje.files.wordpress.com/2020/05/vawowafebunisudarowuzus.pdf
    • https://gupadolajiwu.files.wordpress.com/2020/05/nubovuximi.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000059c8.bin
f918e7e40c3890e0e2168d19e2470bdf888a13ec1692c1e3b58f55b9154bf49d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59C8 13292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.