Malicious PDF — malware analysis report

Static analysis result for SHA-256 9dd2b6474465b844…

MALICIOUS

PDF

39.1 KB Created: 2020-03-28 06:40:31 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 248977632e0e502c851a42829acd9bc3 SHA-1: 38e83e57ef556b106aec20d0f07a2437045de9b5 SHA-256: 9dd2b6474465b844f361f8551588ecbb9823c3346ae07286d17227b26a3f2421
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly indicated maliciousness. The embedded document body text, while partially corrupted, contains a URL that is also present in the list of external links. This suggests the document's primary purpose is to redirect users to a network of potentially malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://helpingheartboston.com/uploads/1/3/0/8/130813025/130813025.html#frog+and+toad+all+year+book+study
    • http://irongoddess.org/uploads/1/3/0/8/130873795/bugagif.pdf
    • http://carrerabusinesssolutions.com/uploads/1/3/0/3/130323163/rebowajexol-nowaludafuli-giditut-fitaxir.pdf
    • http://seattleyouthbaseball.com/uploads/1/3/0/4/130492127/8875cd9c703343e.pdf
    • http://loveslsu.com/uploads/1/3/0/5/130588417/wapegedax.pdf
    • http://stitchwickedshop.com/uploads/1/3/0/6/130621258/9361230.pdf
    • http://www.sbschristmas.com/uploads/1/3/0/7/130739113/ritanaziva_sisebepunezelo_puwejuke.pdf
    • http://nh-dreamhomes.com/uploads/1/3/0/7/130775958/belupepisupoke_dajikonukotov_nixifopugax.pdf
    • http://millsdigital.com/uploads/1/3/0/6/130605510/1890612.pdf
    • http://scgphotographyny.com/uploads/1/3/0/3/130323998/regoxudadiratewa.pdf
    • http://parentsforeczemaresearch.org/uploads/1/3/0/4/130483573/b6a67c5dc.pdf
    • http://allnbaseball.com/uploads/1/3/0/5/130550986/5300f647c89778d.pdf
    • http://breakthemoneymold.com/uploads/1/3/0/2/130289243/vaxixekapitujak_jikemokopet.pdf
    • http://boccesubscription.com/uploads/1/3/0/3/130379202/2f20b4.pdf
    • http://mysunnysummer.com/uploads/1/3/0/5/130551576/c598ff80c.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007725.bin
57c90caebf5f629fbd3eae9ac8fc90be261b95eda28619eb77803cb43a5d00ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7725 9432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.