Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e1fb57662c746ab…

MALICIOUS

PDF

24.9 KB Created: 2020-04-02 23:54:44 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 431af1529b8daceb451415ef3b2273ea SHA-1: e088b8812e2f05a64a42892d49b328f573af3934 SHA-256: 7e1fb57662c746ab4520cb2ea1d2cd8147036814107b9f3432cdbae82f9859b9
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier strongly indicated maliciousness, and the presence of numerous external links suggests a coordinated effort to direct users to potentially harmful resources. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mercyfamilypractice.com/uploads/1/3/0/7/130776403/130776403.html#icons+rpg+review
    • http://ccpcoastalbend.org/uploads/1/3/0/5/130589231/8676066.pdf
    • http://lhaconsult.com/uploads/1/3/0/6/130603867/3156304.pdf
    • http://customanglersrods.com/uploads/1/3/0/6/130605173/tagagu.pdf
    • http://ashliebrookewriting.com/uploads/1/3/0/8/130814976/82d340.pdf
    • http://brunchbunnies.com/uploads/1/3/1/4/131406063/988752.pdf
    • http://empoweringhealthcare.org/uploads/1/3/0/3/130379075/71ba67389ea1e.pdf
    • http://franciestyles.com/uploads/1/3/0/6/130639377/5320430.pdf
    • http://whids.com/uploads/1/3/0/6/130639107/3675c4381ea.pdf
    • http://overthetoproofing.org/uploads/1/3/0/6/130604855/julimu-delop.pdf
    • http://outdoorlivingpros.com/uploads/1/3/0/4/130435898/rapajalekab-seranesosagome.pdf
    • http://mycaliforniahome.us/uploads/1/3/0/8/130874118/c66988d38c.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.