Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a862072010b63ad…

MALICIOUS

PDF

41.7 KB Created: 2020-03-20 10:27:53 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: af85635e09f7c32bba5c417ccf8f999d SHA-1: 94a78aee814f5969045aeb2c49c20414180053a1 SHA-256: 8a862072010b63ad979d27f81f8de696850865fe8b1b5325160989408c2ea69f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO spam operation. The document body, though partially corrupted, includes the phrase 'Instrucciones de como jugar domino cubano' and references wkhtmltopdf, indicating a lure to external content. The ML classifier strongly flagged this PDF as malicious, and the PDF_SEO_LINK_FARM heuristic confirms the suspicious linking behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sashakostya.com/uploads/1/3/0/8/130874472/130874472.html#instrucciones+de+como+jugar+domino+cubano
    • http://themidpost.net/uploads/1/3/0/6/130621808/depaputukiroles_xenororenilud_jejixutukesulan_pimifamibav.pdf
    • http://www.cookiesbykae.com/uploads/1/3/0/7/130740627/sojozaxaj.pdf
    • http://emmajcooperfineart.com/uploads/1/3/0/6/130604086/sixivokino.pdf
    • http://karenandsteve.net/uploads/1/3/0/6/130639471/ef48df3a7e70.pdf
    • http://www.mariadetalles.com/uploads/1/3/0/7/130738984/6815876.pdf
    • http://barksbows.com/uploads/1/3/0/5/130588982/kigugajadorux.pdf
    • http://selfdomination.com/uploads/1/3/0/2/130272372/3261390.pdf
    • http://kresscreative.com/uploads/1/3/0/7/130775728/nutokusodobidof.pdf
    • http://smt-metalltechnik.eu/uploads/1/3/0/7/130776500/4971e188.pdf
    • http://bakasolomon.com/uploads/1/3/0/4/130476332/jigujodi.pdf
    • http://carpentrykingstonuponhull.com/uploads/1/3/0/3/130313198/bobarelevopogagated.pdf
    • http://psychedelicintegrationglasgow.co.uk/uploads/1/3/0/6/130621782/743c4806bc2f.pdf
    • http://www.orgpc.com/uploads/1/3/0/8/130874691/b45082.pdf
    • http://rivron2.net/uploads/1/3/0/4/130494059/muzap_xagizagijek_potinubuwex.pdf
    • http://www.mk6geography.com/uploads/1/3/0/6/130621472/lesutirinuwomi.pdf
    • http://www.zaryliamplace.com.au/uploads/1/3/0/6/130620248/40951803e2224.pdf
    • http://listingrank.com/uploads/1/3/0/6/130604859/dojevutusufik.pdf
    • http://hotelamericainkathmandu.com/uploads/1/3/0/7/130775018/zozuxarola.pdf
    • http://7thst-marketry.com/uploads/1/3/0/4/130488387/donoduworelodinezin.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007972.bin
b16bf497f7126f3f1a08277dbbf6e1e79bf07cf8103ee0de6197cb69c2caf843		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7972 8268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.