Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e8d66670f53ce9d…

MALICIOUS

PDF

43.6 KB Created: 2020-03-25 04:47:15 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b338cc686218a66a544c47f80e436055 SHA-1: 1184315b793e6e77e3788f91c5bc5ac6a309c6ad SHA-256: 8e8d66670f53ce9d9b2240b7f9e4ef3f21c3931a280fa2b801624a1e9a3b4740
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO manipulation tactic. The ML classifier also strongly indicated maliciousness. The document body contains garbled text and what appears to be metadata, but the primary malicious activity is the distribution of numerous URLs pointing to other PDF files, likely to distribute malware or engage in phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://layalarabikatbi.com/uploads/1/3/1/3/131384145/131384145.html#sistema+operativo+mac
    • http://mainstreetpoolsllc.com/uploads/1/3/0/7/130739894/lubige.pdf
    • http://aspectcarlingford.com.au/uploads/1/3/0/5/130546096/libipujoxol.pdf
    • http://studioontenth.com/uploads/1/3/0/7/130739142/dulabenawevaxuj_kuwuritivomax_ruxexafikimu_tefusawupel.pdf
    • http://www.artigo42.com/uploads/1/3/0/4/130483136/1811125.pdf
    • http://www.palemisolutions.com/uploads/1/3/0/6/130621800/9513280.pdf
    • http://photomathel.org/uploads/1/3/0/9/130969572/lojawejowem_xiwapakuwobevij_digixikubu_nisetipofemide.pdf
    • http://partnersinclinicaldiscovery.com/uploads/1/3/0/8/130873916/zevoluteliwosemaso.pdf
    • http://missioncapitaladvisorsinc.com/uploads/1/3/0/5/130551461/totilu_xeseguritosaji.pdf
    • http://adodistribution.com/uploads/1/3/0/6/130621841/3979573.pdf
    • http://vistam.de/uploads/1/3/0/2/130271137/9a7a4b34.pdf
    • http://omodhrain.com/uploads/1/3/0/2/130272851/pogevopo.pdf
    • http://wichitajoyorganics.com/uploads/1/3/0/6/130604725/3755983.pdf
    • http://cufftie.com/uploads/1/3/0/4/130490668/polinajumupa_dunifanizilamix_datazo_zavojuset.pdf
    • http://harleesalazarphotography.com/uploads/1/3/0/5/130552097/vesegagejujimavinati.pdf
    • http://blog.argonauta-boracay.com/uploads/1/3/0/4/130483142/gavujuvowaja.pdf
    • http://embracinglifeconsulting.com/uploads/1/3/0/4/130483961/67dec500.pdf
    • http://clearwash.fr/uploads/1/3/0/5/130543941/5805987.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007266.bin
18244480b92316ad0fd5a7acbd5076bc109095639a68c2bd640e6ec61a0cc2e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7266 8540 bytes
font_01_sfnt_off00009189.bin
7569b11c30ebd15de03f09a64fe9e946cac7bc0e3925d715584d0c29e65d7c8b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9189 3224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.