Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a7e36da62368598…

MALICIOUS

PDF

52.8 KB Created: 2020-04-02 00:07:29 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 97fafd15bc6561d5d42b8da9fc6e82b0 SHA-1: 1e4f561a0cbd5e92c94bf0141d77ec3c126bcf26 SHA-256: 8a7e36da62368598544fcb99000b4fc346bf3cfccafa2e9d5d9eed6cf2afc318
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The heuristic PDF_SEO_LINK_FARM specifically flags this behavior, indicating a likely attempt to distribute malware or phishing content through a link farm. The ML classifier also strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thin.agency/uploads/1/3/1/1/131164558/131164558.html#wow+profession+alchemy+guide+1-+450
    • http://allaboutbeautybypaulinamoran.com/uploads/1/3/1/4/131438517/43f0ddd.pdf
    • http://detroitskiteam.com/uploads/1/3/0/7/130738848/kogadu-vizutaz.pdf
    • http://janicehicks.com/uploads/1/3/0/5/130542936/fuzupepuvikabutiloma.pdf
    • http://wildnery.com/uploads/1/3/0/7/130740258/sokamisodepukigi.pdf
    • http://nofap.site/uploads/1/3/0/6/130621846/84f60ccb45.pdf
    • http://ifixlawns.com/uploads/1/3/0/7/130775267/823d8b4b.pdf
    • http://castoandsonslandscaping.com/uploads/1/3/0/3/130323411/zudorebufoz.pdf
    • http://mensthings.net/uploads/1/3/0/6/130605166/funap_dalegetejufipip_zoxelazezibat_laraxegojaruvi.pdf
    • http://psyneways.com/uploads/1/3/0/6/130603743/1829871.pdf
    • http://enchantedforestweddings.com/uploads/1/3/0/8/130814115/tapifa-ziduna.pdf
    • http://cuddlebuddy.ca/uploads/1/3/0/2/130289266/1126439.pdf
    • http://cityballersathletics.com/uploads/1/3/0/6/130622000/ad592eb0981c6c.pdf
    • http://cheneybeatty.com/uploads/1/3/0/5/130589049/9f4de3696432.pdf
    • http://panopticconsultancy.com/uploads/1/3/0/8/130874627/9711d5fa9f7.pdf
    • http://elizaraspberry.com/uploads/1/3/0/7/130775558/zadavexofibote.pdf
    • http://dentistaparacachorro.com/uploads/1/3/0/6/130621721/fikolinagedo.pdf
    • http://hawaiistationonline.com/uploads/1/3/0/9/130969791/vipigorar.pdf
    • http://solarlandscapes.net/uploads/1/3/0/7/130775276/4670522.pdf
    • http://moutonathletics.com/uploads/1/3/1/3/131381706/nodabujebut.pdf
    • http://sierrabuttesbodywork.com/uploads/1/3/0/8/130874314/vosefogimujowe_daridazonoxiz_siwujepetijo.pdf
    • http://saiom.in/uploads/1/3/0/4/130476440/2487099.pdf
    • http://betterthanbadgamers.com/uploads/1/3/0/7/130776790/8039ccb8c36a8a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a342.bin
d91f7653a7ccc08ec7592537c2adcc2f010fdb48bb00dc3a631389b0221c4f16		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA342 8948 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.