Malicious PDF — malware analysis report

Static analysis result for SHA-256 8dd6dbc5cae71430…

MALICIOUS

PDF

39.6 KB Created: 2020-04-03 13:41:33 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b645b59b6714095d2df57c65914eb881 SHA-1: bd8cff840c195872eef9a5167a6115465404b6df SHA-256: 8dd6dbc5cae71430d7e2aeb843a56a11deffef78502791c8ec4140174aed9cb5
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The embedded document body text, though partially corrupted, contains a URL that matches one of the extracted links. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hivesindmax.com/uploads/1/3/0/6/130620443/130620443.html#que+pila+usa+el+termometro+digital
    • http://wordsmatterart.com/uploads/1/3/0/3/130379362/2958341.pdf
    • http://livingthecrownlife.com/uploads/1/3/0/9/130969889/8b7c9353.pdf
    • http://dreamteamhk.com/uploads/1/3/0/2/130289493/powagujirimiku.pdf
    • http://womenonpar.com/uploads/1/3/1/4/131453540/f5589453269.pdf
    • http://theplayerssocceracademy.com/uploads/1/3/0/4/130476320/denuwoxuwip-jodadegizi-wibawelixuraka.pdf
    • http://ultracooltrends.com/uploads/1/3/1/3/131379389/depuboxojixu.pdf
    • http://bantamlongtail.com/uploads/1/3/0/7/130775791/76592.pdf
    • http://louisaanderic.com/uploads/1/3/0/4/130476878/9266573.pdf
    • http://tightspreads.com/uploads/1/3/0/6/130640150/92660fd6c9eb13.pdf
    • http://ebktmlimited.com/uploads/1/3/0/6/130620997/petum.pdf
    • http://mlachomes.com/uploads/1/3/0/6/130621606/8736260.pdf
    • http://fosterdreamscent.com/uploads/1/3/0/6/130639165/f997c3eb9e.pdf
    • http://tarasnyderonline.com/uploads/1/3/0/2/130288563/mebuseku.pdf
    • http://naplescitynews.com/uploads/1/3/0/6/130620325/linuzesavek_jurudobakog_kuxulu.pdf
    • http://mail.salondtoronto.com/uploads/1/3/0/2/130270991/zebalonulezi.pdf
    • http://sturminsternewtonplan.com/uploads/1/3/0/5/130543276/22cba45635966f8.pdf
    • http://danseycats.com/uploads/1/3/0/5/130551144/ruxeg.pdf
    • http://kentuckymadeandmore.net/uploads/1/3/0/3/130313063/suwufenomidera_vaxixarij.pdf
    • http://nourishedyogi.com/uploads/1/3/0/6/130604620/35c8ea3.pdf
    • http://reigstad4kenton.com/uploads/1/3/0/9/130969065/7938abe4a8f923.pdf
    • http://generationsgenealogy.com/uploads/1/3/1/3/131383982/xalapovepaju.pdf
    • http://renaesreadings.com/uploads/1/3/0/6/130640018/acf927.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007250.bin
834bebde8f696f25c445f0a24f4b7252d621ff464b7a434c268db36861f2bc03		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7250 7868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.