Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d018f4fdd1b6dda…

MALICIOUS

PDF

34.6 KB Created: 2020-04-22 11:05:09 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c09bc76883cae2e4ea3337364485de93 SHA-1: 8c0825f07d6bca7f2c83bf116bc184ff77b2f5ac SHA-256: 9d018f4fdd1b6dda7d64a6fbc05a6c72cf6258aaabc7daf6872520838593142f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which appear to be part of an SEO link farm. The primary lure seems to be a resume template, but the sheer volume of links suggests a malicious intent to drive traffic or distribute further payloads. No scripts were extracted, and the document body was heavily obfuscated, limiting deeper analysis of the immediate intent beyond link distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://angieschickerowski.com/uploads/1/3/0/6/130621134/130621134.html#hr+coordinator+resume+template
    • http://thereidz2001.com/uploads/1/3/1/4/131452937/9d9295.pdf
    • http://nwpregnancyandbirthcoaching.com/uploads/1/3/0/6/130620460/7927919.pdf
    • http://carividavillas.com/uploads/1/3/1/3/131380759/xixeti.pdf
    • http://britecsolutionsinc.com/uploads/1/3/0/8/130874513/pevokekovukal.pdf
    • http://singaporeliondance.com/uploads/1/3/0/2/130289508/tebidemikis-dejisi-nesomedodun-podezapumixub.pdf
    • http://michaelballarddesigns.com/uploads/1/3/0/7/130775921/3574851.pdf
    • http://jdunloading.com/uploads/1/3/1/4/131438639/4025669.pdf
    • http://stormwindcitypatroller.com/uploads/1/3/0/6/130640042/4c7667f50c2da78.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005fae.bin
5f689fee28684c22ad942cab5a231b749381cd2e12ccf5da93ffacc355cc1f77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FAE 8084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.