Malicious PDF — malware analysis report

Static analysis result for SHA-256 942f074f51727c76…

MALICIOUS

PDF

36.7 KB Created: 2020-06-05 15:20:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9efa94ff60af848e076ac747e3478920 SHA-1: a07aaaf38163db03142d14414dc1474d9b6e6c29 SHA-256: 942f074f51727c762f2b0e67ccd46c1bf6d8af7b65707137410e09c83013985d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains a significant number of external links, indicating a link farm or redirection scheme. The document body references 'Witcher 3 wolf gear', a tactic to attract users. The primary attack pattern involves leveraging these external links, likely for SEO spam or to redirect to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wildernesswhalelodge.com/uploads/1/3/1/4/131437311/131437311.html#witcher+3+wolf+gear
    • http://churchilllawyers.com.au/uploads/1/3/0/5/130552073/6601407.pdf
    • http://mail.davidmichaeldesign.com/uploads/1/3/0/5/130588708/4587593.pdf
    • http://velanperinta.fi/uploads/1/3/1/8/131856802/62012840c6a6e4.pdf
    • http://senyalnizdegilsin.com/uploads/1/3/0/6/130621055/tomaz-bovalasazopagi.pdf
    • http://host153.carmichaelnl.com/uploads/1/3/0/5/130539584/428476916c3a07.pdf
    • http://athleteslab.net/uploads/1/3/1/3/131398024/gujezipa.pdf
    • http://plantlocator1.com/uploads/1/3/1/3/131380253/4126943.pdf
    • http://furnituresunderland.com/uploads/1/3/0/7/130739212/4096257.pdf
    • http://autodiscover.nightowlb.com/uploads/1/3/1/4/131438002/bavolumisej.pdf
    • http://wildernesswhalelodge.com/uploads/1/3/1/4/131437311/terms.html
    • http://wildernesswhalelodge.com/uploads/1/3/1/4/131437311/dmca.html
    • http://wildernesswhalelodge.com/uploads/1/3/1/4/131437311/policy.html
    • https://zodajod.files.wordpress.com/2020/06/57135642581.pdf
    • https://kuvajixut.files.wordpress.com/2020/06/pemukemenefumoxafosipi.pdf
    • https://duwopizemole.files.wordpress.com/2020/06/zimedirigejumok.pdf
    • https://wamefufuvu51724974.files.wordpress.com/2020/06/vigevorobizo.pdf
    • https://fokewofupipi.files.wordpress.com/2020/06/pofodazerudomebaza.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062cf.bin
7c78af10f8e8a6f4a511abeea6f93362442119a4de29abcb6e720f998ca274f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62CF 10756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.