PDF malware analysis — malicious · 9f693b580842a0fc

MALICIOUS

PDF

43.5 KB Created: 2020-03-09 07:52:30 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 9c57892fcf79c15eb5ff50398fb178c4 SHA-1: 6ae808ef8c04e7b4084c768a30bf999e3748d859 SHA-256: 9f693b580842a0fc6158dad0425346c9523c006de94c737131051ce1fddd3094

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, a technique commonly used to create link farms for SEO manipulation or to distribute malicious content. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to generate many links, and the ML_NYX_PDF_MALICIOUS score of 0.999988 strongly suggests malicious intent. The document body, though partially corrupted, contains text related to 'solving algebraic expressions worksheet pdf', suggesting a lure to disguise the malicious nature of the links.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://patrickkarn.com/uploads/1/3/0/7/130776056/130776056.html#solving+algebraic+expressions+worksheet+pdf
- http://quistianbeauty.net/uploads/1/3/0/3/130313741/xumuja.pdf
- http://fieldsofloveevents.ca/uploads/1/3/0/4/130488820/3331758.pdf
- http://www.hayes-construction-andson.com/uploads/1/3/0/7/130775729/5150940.pdf
- http://cranfordfishstand.com/uploads/1/3/0/8/130874218/xudavusav.pdf
- http://myadorediamonds.com/uploads/1/3/0/7/130776607/00c6be0f.pdf
- http://activeoregonchiropractic.com/uploads/1/3/0/2/130287413/wofeturudi-bojiwudowipuv-bexid.pdf
- http://mta-sts.yogabeyondyoga.com/uploads/1/3/0/6/130604881/zomigabulepufoxa.pdf
- http://alloverbeauty.uk/uploads/1/3/0/4/130483123/5999020.pdf
- http://christinecarson.net/uploads/1/3/0/7/130776498/353554caadfd.pdf
- http://cosasdemami.com/uploads/1/3/0/4/130483852/wagizetusunagedezaf.pdf
- http://www.saraivaservicoscontabeis.com/uploads/1/3/0/4/130483286/7924868.pdf
- http://www.kohler.in.ua/uploads/1/3/0/7/130775215/7296651.pdf
- http://bneiakivadetroit.org/uploads/1/3/0/7/130775543/6785475.pdf
- http://sunnydoggrooming.com/uploads/1/3/0/5/130588574/8114554ef.pdf
- http://www.sw-photo.ch/uploads/1/3/0/2/130272396/fulixaf.pdf
- http://brasherfamilycareclinic.com/uploads/1/3/0/6/130603853/8789594.pdf
- http://brainbodymindtherapy.com/uploads/1/3/0/3/130324236/1a26d719e167.pdf
- http://yuillcommunitytrust.org/uploads/1/3/0/4/130477882/f4b90ae893.pdf
- http://hostmaster.chrisrudolf.com/uploads/1/3/0/5/130543494/67111fe9538885.pdf
- http://www.integrium.co/uploads/1/3/0/3/130323535/3ee61c714e0c.pdf
- http://hostmaster.c
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006d83.bin` `2728552eed31bf05f08301c714b516e571586247f3ea5e13cf9cf60b6f9680e8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6D83	7436 bytes
`font_01_sfnt_off00008a4f.bin` `f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A4F	16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.