Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f17be9ace61a0e0…

MALICIOUS

PDF

82.1 KB Created: 2020-05-22 04:05:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af4b91113377b39fe5bfb6cb1e4a3e69 SHA-1: c233fa01951fb287e4d6713221a0ada503ba8d25 SHA-256: 9f17be9ace61a0e0f38087937710f95bbf8126768b84395b426ae86bb2a0e520
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files across multiple domains. The ML classifier also flagged this PDF as malicious with high confidence. The primary attack pattern appears to be a link farm, likely intended to distribute further malicious content or manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vegan-joe.com/uploads/1/3/0/4/130476183/130476183.html#tales+of+the+peculiar
    • http://motosofmichigan.com/uploads/1/3/0/3/130313000/4388579.pdf
    • http://cucharalodge.com/uploads/1/3/0/4/130476751/rojoletig_vebupizejur_tubumejoz.pdf
    • http://11russellcourt.com/uploads/1/3/1/6/131606234/nejinabe.pdf
    • http://wildrockwvevents.com/uploads/1/3/0/2/130270873/7376934.pdf
    • http://listeningforlove-poetryforscientists.net/uploads/1/3/0/6/130604467/9951857.pdf
    • http://apengineeringworks.net/uploads/1/3/0/2/130287923/devarawi_zufedavififigaf_zalilarobenepag_peginegesa.pdf
    • http://jjsmexicanfood.net/uploads/1/3/0/5/130588202/4731334.pdf
    • http://oriansbanks.com/uploads/1/3/0/4/130435748/pinobumosisu_xamuviresu_tiruxozag_modupomati.pdf
    • http://mairamtinkhof.de/uploads/1/3/0/5/130550986/turamebatebi-zojawid-vodozije-gaxepe.pdf
    • http://nobriefing.com/uploads/1/3/0/5/130545475/sesiraf_beduxoke_rejenugu_pitexaxewovoge.pdf
    • http://tomlifts.com/uploads/1/3/0/5/130543369/9149799.pdf
    • http://karlaakehurstart.com/uploads/1/3/0/6/130620690/navirem-garomituxu-suwesukuleken.pdf
    • http://tinapetersen.com/uploads/1/3/1/3/131379361/e8ceefd.pdf
    • http://guesthouseinburgundy.com/uploads/1/3/0/4/130493143/rejusodenifu_zazaj.pdf
    • http://languagerevitalizers.org/uploads/1/3/0/6/130605278/2069698.pdf
    • http://flattaxidermy.com/uploads/1/3/1/6/131637276/900330.pdf
    • http://arbeatz.com/uploads/1/3/1/4/131406569/duwapiwezojirodol.pdf
    • http://compresoresderefrigeracion.com/uploads/1/3/0/6/130620492/meruveg_gapetebo.pdf
    • http://rishi-holdings.com/uploads/1/3/1/3/131380208/fogizitiwudesu_duxegonof_mulubas.pdf
    • http://travel-saving.com/uploads/1/3/0/4/130489159/wasilivezoketori.pdf
    • http://topdecor.org/uploads/1/3/0/6/130639428/831335.pdf
    • http://majasjostromart.com/uploads/1/3/0/2/130289692/833887.pdf
    • http://barnesconstructionservices.net/uploads/1/3/1/4/131454986/df81fb79a3.pdf
    • http://projectcece.org/uploads/1/3/0/6/130621473/xizajiwajemetosak.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011590.bin
7654fcc4f69d06f2041fc011fc3f60716369cb2b51a4e8c783102525c808cae1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11590 11304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.