Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4782edad056f9d7…

MALICIOUS

PDF

25.9 KB Created: 2020-04-05 05:21:37 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f04397579c919b86d4256b3df826897f SHA-1: 5641861c985f1c4cf28b914326241a9ac584ca60 SHA-256: a4782edad056f9d766dbd081a4ee715db227024558d31e607a0d51d43bd44a67
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO poisoning tactic. The document body, while containing a specific appliance query, is likely a lure to encourage users to click on the embedded URLs. The ML classifier strongly indicates maliciousness, and the presence of numerous external links points towards a redirection or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://earthlyguru.com/uploads/1/3/0/2/130270768/130270768.html#frigidaire+dishwasher+all+3+lights+flashing
    • http://wisdomorigin.net/uploads/1/3/0/4/130435941/461805.pdf
    • http://growertogrower.com/uploads/1/3/0/6/130605143/c0b048d0efa.pdf
    • http://vintageandpaintcans.com/uploads/1/3/0/7/130775848/wunefopolo_rupiko_jemelotato_ridowutop.pdf
    • http://thinkhodges.com/uploads/1/3/0/6/130621749/rupameraja.pdf
    • http://youngprogressivesky.com/uploads/1/3/1/0/131070733/ribaravali.pdf
    • http://ieyeofthesoul.com/uploads/1/3/0/5/130545360/9ef1154ed58e30.pdf
    • http://smartermoney-networkmarketingaustralia.com/uploads/1/3/0/7/130775655/bulopirazi.pdf
    • http://mohairregrowthsystem.com/uploads/1/3/0/3/130379462/b7831.pdf
    • http://sunriseimage.info/uploads/1/3/0/6/130604117/6267802.pdf
    • http://pafiried.trade/uploads/1/3/0/6/130621002/xolujilimozo.pdf
    • http://jinwonhanglass.com/uploads/1/3/0/2/130291365/wobiwesanadixoxapow.pdf
    • http://tinamariemateja.com/uploads/1/3/0/4/130476709/rijulijosa.pdf
    • http://recompare.de/uploads/1/3/0/6/130620649/dixidazevupeworek.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.