PDF malware analysis — malicious · a4a57b9f778c1569

MALICIOUS

PDF

55.4 KB Created: 2020-03-23 12:50:46 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: b3495dbac27b5a820ac1a939e80d76c7 SHA-1: 0c2343ec911c899ef602b835c8f4a7cc3f7b7aa7 SHA-256: a4a57b9f778c156970dbb8d3eb41d872a8d7b77f37f897bdf77c5849439a657e

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The document body contains garbled text but also includes the URL http://airzimm.com/uploads/1/3/0/5/130589222/130589222.html#resumen+del+acuerdo+592+en+word, which is one of many external links pointing to PDF files on various domains. This suggests a link farm or SEO poisoning attack designed to redirect users to potentially malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://airzimm.com/uploads/1/3/0/5/130589222/130589222.html#resumen+del+acuerdo+592+en+word
- http://eltnepal.com/uploads/1/3/0/6/130605084/7c23cd36d37af21.pdf
- http://everythingisupstream.net/uploads/1/3/0/8/130874063/setejezafofa-fekubedusulel.pdf
- http://crown-of-glory.com/uploads/1/3/0/7/130739472/492b0f1c.pdf
- http://dwellingwellmom.com/uploads/1/3/0/5/130542822/zararibi_fogegapozutofi.pdf
- http://www.yuma-lifestyle.eu/uploads/1/3/0/6/130640053/17f8b2c69a.pdf
- http://stevenspharmacy.com/uploads/1/3/0/5/130550723/8ad0e2ad9f94278.pdf
- http://www.tiedinvermont.com/uploads/1/3/0/6/130621503/4088263.pdf
- http://skiappartement-saintgervais.com/uploads/1/3/0/8/130874424/8901827.pdf
- http://www.mrboydsclass.com/uploads/1/3/0/3/130379210/ed6ae.pdf
- http://acerecoverygroup.com/uploads/1/3/0/7/130739269/5812938.pdf
- http://carsonlane.com/uploads/1/3/0/8/130814596/7430831.pdf
- http://www.baanjaidee.com/uploads/1/3/0/7/130776100/firifujoduz.pdf
- http://directinservicetraining.com/uploads/1/3/0/7/130739094/24dff95d.pdf
- http://pureromancebyrenee.com/uploads/1/3/0/5/130540869/d2abd241475b.pdf
- http://orangexam.com/uploads/1/3/0/9/130969339/d4adbd6b.pdf
- http://dokimossadecv.com/uploads/1/3/0/6/130620930/8fa512c.pdf
- http://parkshoreplazafolsom.com/uploads/1/3/0/5/130589054/wunusefuwafezatimet.pdf
- http://nekoknives.com/uploads/1/3/0/4/130488123/888ee84f7109f.pdf
- http://yourangelcircle.com/uploads/1/3/0/2/130287973/wozebidiwe.pdf
- http://www.trueinnovation.net/uploads/1/3/0/3/130313274/sebutopafesuvifena.pdf
- http://thequalitynerd.com/uploads/1/3/0/8/130815303/2768205.pdf
- http://prodsquad.net/uploads/1/3/0/6/130639054/c6ad35e.pdf
- http://southernsassboutique.org/uploads/1/3/0/7/130776253/37d5c.pdf
- http://www.lucilindagarcia4nmhouse52.com/uploads/1/3/0/2/130289295/zeduzobusov.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ae4e.bin` `9e743949dfbe425a2f5dbde8cb40750e751e888ee628d6da5f00bed0aa4f9221`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAE4E	8848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.