PDF malware analysis — malicious · 94f743c341b2d7d7

MALICIOUS

PDF

40.4 KB Created: 2020-05-18 05:48:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b7e96066b655822686dcdf7072c320ca SHA-1: 807d701fbb5ea5d73860a786c523c308a7027ed9 SHA-256: 94f743c341b2d7d7220f9940faf35fc6cf4c7069dae584f95cd8fe619a06e789

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO spam operation. The document body, though partially corrupted, contains keywords related to 'Goodyear assurance comfortred touring review consumer reports', indicating a lure to attract users to these external sites. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious link farm.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://askwilliam.org/uploads/1/3/0/2/130272629/130272629.html#goodyear+assurance+comfortred+touring+review+consumer+reports
- http://mychicchateau.com/uploads/1/3/1/4/131453352/wewolemolejuriwa.pdf
- http://noahsrainbows.com/uploads/1/3/0/4/130483498/5507295.pdf
- http://shopbimbe.com/uploads/1/3/0/4/130477775/eb24c92c2.pdf
- http://theartoferika.net/uploads/1/3/1/3/131379598/9677891.pdf
- http://thirdmoment.net/uploads/1/3/0/5/130590420/gatutenadaned.pdf
- http://kosherology.com/uploads/1/3/0/5/130588248/6168876.pdf
- http://bespokeghi.org/uploads/1/3/1/3/131398576/sumifuxugodot.pdf
- http://connectedimpression.net/uploads/1/3/0/4/130477719/bofufesi.pdf
- http://stuartolivermusic.com/uploads/1/3/0/7/130739938/2b7bd4f010.pdf
- http://frenchquartourkids.com/uploads/1/3/0/3/130323932/3979592.pdf
- http://waconda.com/uploads/1/3/0/5/130550774/8366071.pdf
- http://califireco.com/uploads/1/3/1/3/131380651/zarupagigi.pdf
- http://marcoantoniopatrizio.com/uploads/1/3/0/6/130640027/zejaden.pdf
- http://becomingmoore.org/uploads/1/3/0/5/130552055/bebc67bd4d8e6.pdf
- http://districtsforchico.com/uploads/1/3/0/4/130435794/294574.pdf
- http://artcabo.com/uploads/1/3/1/3/131379268/piwapilimiko.pdf
- http://sheilaannbooks.com/uploads/1/3/1/1/131163787/pataki_sonexepiwada_tutujetif.pdf
- http://sexybody.in/uploads/1/3/1/4/131407572/7741508.pdf
- http://mayusilkart.org/uploads/1/3/0/7/130739640/jomujavejedekux-jerogipatesuja-gixeve.pdf
- http://sambucobarber.com/uploads/1/3/1/0/131070305/denetumudariwevox.pdf
- http://proaeroservellc.com/uploads/1/3/1/4/131438622/nexujizagagudokede.pdf
- http://thewisewomancompanion.com/uploads/1/3/0/2/130288720/e84275e43b86.pdf
- http://pacificwoodsigns.com/uploads/1/3/0/7/130776015/8702290.pdf
- http://stephensilberling.com/uploads/1/3/1/6/131606325/1096224.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006ea3.bin` `8d02c22f26035f37f7f58da6c3f71c1e444dcaffeefadc749c4746611b1f7868`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6EA3	11148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.