Malicious PDF — malware analysis report

Static analysis result for SHA-256 964180bf0c72e59e…

MALICIOUS

PDF

38.1 KB Created: 2020-04-11 08:55:04 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b61439c084622b09c7d00cb2e9463fb5 SHA-1: 7b3a3c3c2cc70672f6384c549033344fcf1cc69d SHA-256: 964180bf0c72e59e28385660bdf1c8e1d41b141885fcf10a40b791cf2586eb71
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, many of which point to other PDF files with numeric or generic slugs, suggesting a link farm or SEO poisoning tactic. The document body, though heavily obfuscated, contains references to a 'Dungeons and dragons art and arcana special edition review' and the wkhtmltopdf tool, likely serving as a lure. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous unknown-reputation URLs indicates a high likelihood of malicious redirection or hosting.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pameladirnberger.com/uploads/1/3/0/5/130545493/130545493.html#dungeons+and+dragons+art+and+arcana+special+edition+review
    • http://haugenmediaogdesign.com/uploads/1/3/0/6/130605094/razupuvowefo-mefodupavulu-ruxug.pdf
    • http://oasisforfreethinkers.com/uploads/1/3/0/5/130588980/a46d7fbb0953.pdf
    • http://soxpal.com/uploads/1/3/0/5/130539203/6554507.pdf
    • http://terimorning.com/uploads/1/3/1/1/131163786/mibapokuxuxavezoxe.pdf
    • http://shundorhair.com/uploads/1/3/0/2/130291676/9021626.pdf
    • http://connectionsonthebay.com/uploads/1/3/0/2/130287960/darimiv.pdf
    • http://jdrconsultancy.net/uploads/1/3/0/6/130620525/mamofazamam.pdf
    • http://beerwanderer.com/uploads/1/3/0/7/130775029/rivon.pdf
    • http://futuredreamweaver.com/uploads/1/3/0/6/130621719/xitejekubija.pdf
    • http://artsandcraft.beer/uploads/1/3/1/4/131411150/xiwaboxujezon_veganupal.pdf
    • http://m.lauradick.com/uploads/1/3/1/3/131384169/4079a3ffd4a10.pdf
    • http://surggripper.com/uploads/1/3/0/7/130775714/fejukusu-gewen-figabibesoto-lomiboxit.pdf
    • http://allmyrelationsdoc.com/uploads/1/3/0/3/130312983/6438930.pdf
    • http://jobsindriving.com/uploads/1/3/0/9/130969424/40f225fa2dded.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b10.bin
1b5df9b11d689cd6a1b26223f78465e8bf3addebfdb82533a4ae78b402f173a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B10 8456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.