Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f9c2343e0e593fb…

MALICIOUS

PDF

35.4 KB Created: 2020-03-18 02:56:08 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ad57a26c83c50f47bff601b8c65df2f0 SHA-1: af2a9030c52b264d592e6957f0b8ac4c89f93b64 SHA-256: 7f9c2343e0e593fbdf864a1e7fc3a308370ff9fa0ed3952da0aa612a79e5c863
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to various domains, indicating a link farm or SEO spamming operation. The primary heuristic, PDF_SEO_LINK_FARM, confirms this by detecting a mass of external PDF links. The embedded URL also points to a potentially malicious HTML file. The document body is heavily obfuscated and contains junk data, but the presence of numerous external links is the most significant indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://handymanbrandonco.com/uploads/1/3/0/6/130621575/130621575.html#sungwoon+tell+me+i+love+you+lyrics
    • http://picturecatcher.com/uploads/1/3/0/2/130272232/5453110.pdf
    • http://seniors-shop.com/uploads/1/3/0/3/130379087/bafavusixive.pdf
    • http://mybulletproofart.com/uploads/1/3/0/3/130379363/8936231.pdf
    • http://dsabids.com/uploads/1/3/0/7/130775275/kufopijulasizamasep.pdf
    • http://hostmaster.flcv.org/uploads/1/3/0/6/130605174/fa24e289a6bc.pdf
    • http://www.kevinwpowers.com/uploads/1/3/0/4/130483491/4688393.pdf
    • http://noahguystaffing.com/uploads/1/3/0/7/130776587/ropolotu-bipirez.pdf
    • http://kuechenmeister-schuhe.de/uploads/1/3/0/6/130640102/kuvogifurubek_tomoputi_xululazej.pdf
    • http://friendsofcherryvalleylibrary.org/uploads/1/3/0/7/130776418/893271.pdf
    • http://nickumelectric.com/uploads/1/3/0/6/130639498/b6f9a.pdf
    • http://www.chrisramseyart.com/uploads/1/3/0/5/130541462/junarekenazopimuw.pdf
    • http://myeutv.online/uploads/1/3/0/7/130775002/nogusufasudizu-munitowebuvib.pdf
    • http://positivelygroovy.net/uploads/1/3/0/2/130272955/pifikideraxaxixovoj.pdf
    • http://ns3.becksusedappliances.com/uploads/1/3/0/5/130551235/4592fdc95c9b7.pdf
    • http://www.calendar.ladyfred.com/uploads/1/3/0/2/130291766/puxix.pdf
    • http://jnrconstruction.net/uploads/1/3/0/6/130621717/tutowotexegu-vavulitemos-lodolunagoj.pdf
    • http://jjlliving.com/uploads/1/3/0/8/130874156/7804204.pdf
    • http://ingridsolbrig.com/uploads/1/3/0/7/130739747/fugosuwep.pdf
    • http://flaviosalon.com/uploads/1/3/0/5/130541552/4750682.pdf
    • http://texashelicopterhoghunting.com/uploads/1/3/0/5/130539344/womebop.pdf
    • http://cpanel.mandelnewman.com/uploads/1/3/0/3/130323268/7ad70a12895a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062e2.bin
499d29c76e32b54db163fb19cded30041bba8a9bb44a1e2f2f71a577a82051bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62E2 7668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.