Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1a82d279bd3b111…

MALICIOUS

PDF

82.1 KB Created: 2020-03-31 20:32:12 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: bdf7acdb9e342e2bc6d0c318bffbc1bb SHA-1: e96fb931ba7d2d4023011b7379e0f5afea477fa0 SHA-256: a1a82d279bd3b1113780070bbf6fdb460b6b59e82575de6eab90fa1f8bec9720
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by an ML classifier and exhibits characteristics of a PDF SEO link farm, containing numerous external links to other PDF files hosted on various domains. The document body, though partially corrupted, contains a URL that points to a page discussing Greek polis, suggesting a potential lure or content masking technique. The primary attack pattern involves redirecting users to these external sites, which are likely hosting malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://navice.org/uploads/1/3/0/6/130621307/130621307.html#quienes+eran+los+polis+griegos
    • http://makingithappendowntown.com/uploads/1/3/0/6/130604276/6397215.pdf
    • http://elarsenal.org/uploads/1/3/0/6/130605506/7654348.pdf
    • http://socialspirituality.net/uploads/1/3/0/7/130739963/mewujeropife-pividenut-wemelakaz-xuvulifajanewo.pdf
    • http://vcusom2020.com/uploads/1/3/0/5/130588954/tuwobirime.pdf
    • http://omgevingsboekmabobasis.com/uploads/1/3/0/6/130639675/8761311.pdf
    • http://philprops.com/uploads/1/3/0/6/130603709/sigino.pdf
    • http://bakersfieldice.net/uploads/1/3/0/6/130622106/e6fdda5cf815e9.pdf
    • http://brtennisexperience.com/uploads/1/3/0/7/130739791/34ca8d30bfce.pdf
    • http://howeyinsuranceconsulting.com/uploads/1/3/0/4/130483781/dibabimipeku_dijeno.pdf
    • http://ceramicnano.net/uploads/1/3/0/2/130288861/kutugu-solokowef.pdf
    • http://meljgrey.com/uploads/1/3/0/7/130739143/nujeselovidul-velume.pdf
    • http://cchsmathematics.com/uploads/1/3/0/6/130604850/rulivanuz.pdf
    • http://acrosstheseafamily.com/uploads/1/3/0/6/130605384/rixugota.pdf
    • http://nexustempe.com/uploads/1/3/0/7/130775856/2403453.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db91.bin
ff0302f1ef2e83685aba4c073497ef415e7dc05a7ece4bce5d3a853a944da573		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB91 11804 bytes
font_01_sfnt_off000102b7.bin
8fc19a718616d466f0eb10ba4d5c92e2013dd4fe1e3e4e749dced411529b8631		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102B7 5796 bytes
font_02_sfnt_off0001155b.bin
89282cd3809d3405c0755cd68114e332fc6079a1c5e012c6a95e868af0177445		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1155B 4580 bytes
font_03_sfnt_off00012419.bin
d8d057a5bbcbe5203d9b5ac9abc9570e145ca9fc17bf3766c8a265d856d7ea4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12419 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.