Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2e773ead91a1961…

MALICIOUS

PDF

53.3 KB Created: 2020-05-06 08:17:47 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a4332aaed649fae7f12d2b06503c2868 SHA-1: 88be0f493e445b41e0bbf1ad0218c3ecdef0ba06 SHA-256: a2e773ead91a196104393c7ce8a204bd4dfcdfbadc29d7580df47dbd4553b0b1
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged by a machine learning classifier as malicious. It contains a large number of external links, many of which point to PDF files with numeric or generic slugs, suggesting a link farm or SEO abuse tactic. One of the embedded links, http://ecgcore.com/uploads/1/3/0/7/130738885/130738885.html#capitec+app++for+samsung+z2, specifically mentions a mobile application, indicating a potential phishing lure. The document body is heavily obfuscated and contains many of these URLs, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ecgcore.com/uploads/1/3/0/7/130738885/130738885.html#capitec+app++for+samsung+z2
    • http://crescentwholehealth.com/uploads/1/3/0/7/130776805/xutepodulu.pdf
    • http://jewelrystudiowellfleet.com/uploads/1/3/0/5/130544043/fasokelum.pdf
    • http://carlenfinch.com/uploads/1/3/0/4/130483070/30840.pdf
    • http://empowermentessentials.co/uploads/1/3/1/4/131438385/zodorufajikazon.pdf
    • http://maxxvapors.net/uploads/1/3/1/4/131411688/tiwenutulor_lumos_zikipiwujap_pimew.pdf
    • http://demservicesautomobiles.com/uploads/1/3/0/4/130476344/3627932.pdf
    • http://hebrewscoffee.com/uploads/1/3/0/9/130969829/gamozurafali-soladala.pdf
    • http://radicalingenuity.group/uploads/1/3/0/7/130738771/mirado-zuwizuzuzamafir.pdf
    • http://heavenlydelightbakery.net/uploads/1/3/0/5/130544321/454f4161a243c.pdf
    • http://thepictureofthedayfilm.com/uploads/1/3/1/1/131164016/3770090.pdf
    • http://tenayatechnologies.com/uploads/1/3/0/9/130969565/tulob.pdf
    • http://samschuth.com/uploads/1/3/0/8/130813967/5294536.pdf
    • http://alexjkrause.com/uploads/1/3/0/5/130588349/7d04a7e68448.pdf
    • http://firstmam.com/uploads/1/3/0/3/130313091/jimupagoko.pdf
    • http://the-fword.net/uploads/1/3/0/7/130776255/xaxukosanawunebason.pdf
    • http://kmacautomation.com/uploads/1/3/0/7/130776592/fe177c9a3f14.pdf
    • http://sellingyourartwork.com/uploads/1/3/0/5/130588744/fokur_xilom_sodakuratejuru_sabutaloludexa.pdf
    • http://richiwong.com/uploads/1/3/0/2/130291699/mufale_jovalufotixef.pdf
    • http://sylvaniotours.com/uploads/1/3/0/7/130775309/mamofurawimobinuji.pdf
    • http://fxdphotography.com/uploads/1/3/0/8/130813783/ace054c9ede.pdf
    • http://dessante.com/uploads/1/3/0/3/130324315/donarogimawa.pdf
    • http://desertskydoodles.com/uploads/1/3/0/8/130813913/zoxukagazebemipineku.pdf
    • http://2-eaz.com/uploads/1/3/1/4/131453348/8753364.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008d3b.bin
27cc67f38cdfbeadb231beeb3f4058b6e05a69d33ed37524cb8e4b348d8589ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D3B 11216 bytes
font_01_sfnt_off0000b3a3.bin
21e25ec7093e2b71d69d7a70f7af90a4e45b8332f0c3113bec0257aa59e8f5f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB3A3 16716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.