Malicious PDF — malware analysis report

Static analysis result for SHA-256 9eefb85d8abaa52c…

MALICIOUS

PDF

50.6 KB Created: 2020-03-25 06:00:13 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b452b24b81b53e1e9445199aa56e2d56 SHA-1: 7ef3c8f329253416f9bb8c289700f86abe6b4fe3 SHA-256: 9eefb85d8abaa52c2ac953eaf82f4528831c6fcea72de52422d1fce4d15ff35f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document was flagged by a machine learning classifier as malicious. It contains a large number of external links, many with numeric slugs, indicative of a link farm or SEO spamming technique. The primary purpose appears to be to distribute a large volume of links to potentially malicious or low-reputation websites, rather than delivering a direct exploit or payload within the PDF itself. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://skinspiritlife.com/uploads/1/3/0/4/130483184/130483184.html#definicion+de+media+armonica+y+geometrica
    • http://www.expeditionfam.com/uploads/1/3/0/2/130288447/13c5215f5eebe4c.pdf
    • http://tri-valleyjewelryandmetalsmithingclasses.com/uploads/1/3/0/7/130775805/gufodovopatu-ragixewesu.pdf
    • http://reconcileaustraliaparty.org/uploads/1/3/0/6/130639408/tiwekuki.pdf
    • http://roommatestheshow.com/uploads/1/3/0/6/130603919/5645d83237fd4e.pdf
    • http://diapersanddogfood.com/uploads/1/3/0/2/130272271/gevexefu.pdf
    • http://proofpositiveakron.com/uploads/1/3/0/5/130588721/164922.pdf
    • http://beccakelley.com/uploads/1/3/0/6/130620750/gaxivojosopukar-pusikunazu.pdf
    • http://natgilbert.com/uploads/1/3/0/4/130436130/liwuzofam_xamiwefij.pdf
    • http://eecph.org/uploads/1/3/0/7/130739274/mobubezibumudexuwi.pdf
    • http://dawnwilcoxlcsw.com/uploads/1/3/0/9/130969804/4969517.pdf
    • http://bartlettelectric.org/uploads/1/3/0/4/130436271/zexavipex-buvoxe.pdf
    • http://bellovaporizer.com/uploads/1/3/0/6/130621584/vekuv_disilezilani_rifelawavuzarun.pdf
    • http://delseronline.com/uploads/1/3/0/5/130542729/8971664.pdf
    • http://mrviolinsd.com/uploads/1/3/0/7/130776875/5697978.pdf
    • http://e-qm.be/uploads/1/3/0/6/130604161/zefusorelaze.pdf
    • http://www.ranchcandy.com/uploads/1/3/0/5/130589133/e7c65c2f724b66.pdf
    • http://treasurehunthongkong.com/uploads/1/3/0/2/130270887/399e205058b3b.pdf
    • http://positiveenergyny.com/uploads/1/3/0/2/130291712/32261.pdf
    • http://canberrajewishcommunity.org/uploads/1/3/0/6/130604079/wefufa.pdf
    • http://angoloitek.com/uploads/1/3/0/4/130435548/pojizu.pdf
    • http://www.birminghamobediencetrainingclub.com/uploads/1/3/0/7/130775407/6774691.pdf
    • http://www.my-home-cooking.com/uploads/1/3/0/3/130323141/668925.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007970.bin
afec33353b228df844b0062ffe6eeba2035caa8dbdb604010932705ca50a0724		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7970 9068 bytes
font_01_sfnt_off00009a73.bin
e4e0fc6f62dbd1925d544a400eed3d2e1495cb256299968c7a35a52bebce31cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A73 3104 bytes
font_02_sfnt_off0000a4f9.bin
65ca2fa633a49bc637c245e3469a24bec82cbb291b9200d770c42ee2df1588ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4F9 16096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.