Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b450fba6d3fd117…

MALICIOUS

PDF

49.4 KB Created: 2020-03-29 10:52:21 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9f05ba1c681ec22604b049bccc476ef8 SHA-1: d79a78648a081addf771e6504203f24ddc074d3c SHA-256: 9b450fba6d3fd117ec3b37cba8d169169eb12b253ef47135ec1979ad308c86e6
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous links to external websites, presented as a "link farm" for SEO purposes. The document body explicitly mentions downloading a game, and the embedded URLs lead to PDF files hosted on various domains, suggesting a phishing or malware distribution attempt. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hotelvic-phase2-ko.devsite-1.com/uploads/1/3/0/7/130775199/130775199.html#download+game+dragon+ball+z+budokai+tenkaichi+3+pc+rar
    • http://bccbuckscountycornhole.com/uploads/1/3/0/4/130476396/dipebaxitix_fafawakig_valozadabevitu.pdf
    • http://krasser-andreas.com/uploads/1/3/0/6/130604169/wufit.pdf
    • http://mindfulnessforeveryone.com/uploads/1/3/0/5/130539215/digadixonu.pdf
    • http://neweramovementllc.com/uploads/1/3/0/9/130969533/1842033.pdf
    • http://attorneymarkanderson.com/uploads/1/3/0/2/130272485/gilenamuril-goveguvos.pdf
    • http://mta-sts.mail.manheimtouchdownclub.com/uploads/1/3/0/4/130436242/netaziti.pdf
    • http://chicagocbdsurvey.com/uploads/1/3/0/3/130323161/7ed84.pdf
    • http://autodiscover.virginiabaptistscommitted.org/uploads/1/3/0/8/130813399/wamalu.pdf
    • http://highlifemarijuana.com/uploads/1/3/0/6/130639750/675738.pdf
    • http://ocumoney.com/uploads/1/3/0/5/130551006/kagugufe_jivew_rawonisowazija.pdf
    • http://woodstreamga.com/uploads/1/3/0/7/130776295/zivax.pdf
    • http://carlsongracieencinitas.com/uploads/1/3/0/8/130813616/gaguluzonim_rureti_verufabaw.pdf
    • http://teampowerelectric.com/uploads/1/3/0/5/130551597/3206ca2fdf8f9c.pdf
    • http://shared-insight.com/uploads/1/3/0/2/130273872/8149170.pdf
    • http://pushthenote.com/uploads/1/3/0/8/130814576/lenebuxopolomiwosol.pdf
    • http://revelationsmagazine.com/uploads/1/3/0/6/130640172/vomixubanefezed.pdf
    • http://noukapab2.com/uploads/1/3/0/2/130288426/ziditujarezela.pdf
    • http://bonitolson.com/uploads/1/3/0/2/130270826/9244520.pdf
    • http://insitepropertymanagement.net/uploads/1/3/0/6/130639160/nazuw.pdf
    • http://london-pet-grooming.co.uk/uploads/1/3/0/2/130292014/zekeja.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008014.bin
2e6d8380aab3ae23cabc1a8abd7693340b3d08eb2c9efd72b7f24cccec7281b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8014 9180 bytes
font_01_sfnt_off0000a282.bin
8d17431ef57e68df5a12c688c561c816e2bf4da9e9402592eb5a9506436888c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA282 6408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.