Malicious PDF — malware analysis report

Static analysis result for SHA-256 937d17edef9850d0…

MALICIOUS

PDF

41.3 KB Created: 2020-04-21 00:19:19 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9b2b9cf171cc23c7ec8d58fa02689bce SHA-1: 3f679ed2d2d77add5025327b6a577277b7d7882d SHA-256: 937d17edef9850d06f87963e241fa1a9e6b4538031f4aeee8bb16f2cea77a647
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file contains a large number of external links, indicating a link farm strategy to distribute malicious content. The ML classifier strongly flagged this PDF as malicious. The primary attack pattern involves luring the user to click on one of the numerous embedded URLs, which likely leads to a compromised website or a direct download of further malware. No scripts were extracted, but the PDF structure itself is the delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://insurewithhoward.com/uploads/1/3/0/6/130604778/130604778.html#touch+screen+calibration+test+pro+apk
    • http://dpvavote.com/uploads/1/3/0/4/130491850/e16a2.pdf
    • http://solelimpezas.com/uploads/1/3/0/7/130738725/44f9d589e393c5f.pdf
    • http://forgottenindustry.com/uploads/1/3/0/7/130740158/8a8a837.pdf
    • http://gospelsupply.org/uploads/1/3/0/7/130739967/3849543.pdf
    • http://laboutiqueunique.com/uploads/1/3/1/6/131637365/2473189.pdf
    • http://tafski.org/uploads/1/3/1/4/131406487/88f2cd18c7c7f.pdf
    • http://simpsonhomeinspections.com/uploads/1/3/0/6/130604615/cf8769c4151.pdf
    • http://beaudefautbybriacharlise.com/uploads/1/3/0/5/130588982/lofuvopuzobade-jamagofodobobon-vizaxodinim-gagix.pdf
    • http://brennangcservices.com/uploads/1/3/0/4/130488500/1ecfea32.pdf
    • http://lookfantasticfacilities.com/uploads/1/3/0/2/130289573/7c65ecf74df727.pdf
    • http://marijuanadeliverysanbernardino.com/uploads/1/3/0/2/130289803/7766045.pdf
    • http://tafski.org/uploads/1/3/1/4/1314
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000792e.bin
ddb5a4a229f70b551e97339002454f3f4606313930f151cba1c8c7cbde93eb09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x792E 8260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.