PDF malware analysis — malicious · 9e63340ac1d2fc23

MALICIOUS

PDF

86.6 KB Created: 2020-06-07 01:29:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a74b32cea85afdc5750b19b25824ae46 SHA-1: f16b1d9cda82b91fb0b0e012156cc75848a7aa66 SHA-256: 9e63340ac1d2fc2358c05eba40b3ce09829ac87f6d4167c4f9879b5289bd56d7

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO manipulation tactic. One prominent link points to 'http://74-123-73-216.mgwnet.com/uploads/1/3/1/1/131164481/131164481.html#morphe+c%25C3%25B3digos+de+youtubers', which is likely a lure. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the suspicious linking behavior.

Machine Learning

Nyx PDF Classifier malicious score 0.9967

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://74-123-73-216.mgwnet.com/uploads/1/3/1/1/131164481/131164481.html#morphe+c%25C3%25B3digos+de+youtubers
- http://jlsupplies.co.uk/uploads/1/3/0/7/130776555/7810770.pdf
- http://thecountryovenbakery.com/uploads/1/3/1/6/131606000/295963.pdf
- http://hostmaster.selpro.co.uk/uploads/1/3/1/4/131454265/726c18.pdf
- https://tosukovexe.files.wordpress.com/2020/06/sejegetitel.pdf
- https://midogafabub.files.wordpress.com/2020/06/zizalolevexurega.pdf
- https://nonuwivab179611077.files.wordpress.com/2020/06/rezumuvisitopudesagisemo.pdf
- https://pumopegebar.files.wordpress.com/2020/06/setulojurofivogav.pdf
- https://pumopegebar.files.wordpress.com/2020/06/88855184036.pdf
- https://guwizirufesi.files.wordpress.com/2020/06/80947639279.pdf
- https://bisapabak.files.wordpress.com/2020/06/12483959621.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007bce.bin` `08c2d8041370a39d0814f0402bc158080a31aa6acef7f76b917da91b30853b33`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7BCE	7088 bytes
`font_01_sfnt_off00008dad.bin` `193d32c23c9e9c82fbdee6e2bc1bdd9ee8a417d750745d8ff13c513078424563`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DAD	3120 bytes
`font_02_sfnt_off000098cd.bin` `96ff7e32b857bcd473536fc81ea12db40af0ba3063047274e2733198116a06c0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x98CD	9136 bytes
`font_03_sfnt_off0000aa0c.bin` `58d0d87bc7630372d53d107c8aa5246c5e1c4e08e4ce09a088c7dfffa6cff0b7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAA0C	8424 bytes
`font_04_sfnt_off0000c6c1.bin` `1bbd7bec45ffc0cba9a73b1292ab52c5e05eb6afcc8504431024e72f5763f821`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC6C1	13964 bytes
`font_05_sfnt_off0000f466.bin` `6831ac3a28124fcca6d5674b721a2a6e57f8bc32f3cbc1a2ca9187e5949a8cd4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF466	33052 bytes
`font_06_sfnt_off00013bbb.bin` `815f16576f522f951cf05861edd81ede55246175028000d271c99a1fb89e613c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13BBB	6080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.