Malicious PDF — malware analysis report

Static analysis result for SHA-256 a57199d0cfbeb63a…

MALICIOUS

PDF

44.8 KB Created: 2020-03-29 13:26:38 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a776b1d2caad4eea23bf07c428bb28de SHA-1: 5f7672bd73e679653e4be5514593476d880dd970 SHA-256: a57199d0cfbeb63a4e5f1e5a58f08b55f4243593d3ffd4ce5f82f800d62e6c1b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

This PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text is mostly obfuscated, but the presence of numerous URLs suggests a link farm or SEO spamming operation. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://afaparents.org/uploads/1/3/0/5/130589178/130589178.html#tabla+de+multiplicar+del+35+hasta+el+50
    • http://exchangeclubmobile.org/uploads/1/3/0/6/130603890/638a692d.pdf
    • http://loddonprimaryswimmers.org/uploads/1/3/0/7/130775154/4748179.pdf
    • http://leeeyecare.net/uploads/1/3/0/6/130640015/putixejoxajenonu.pdf
    • http://marmulintegrated.com/uploads/1/3/0/7/130739705/1400592.pdf
    • http://ns.sjoachim.org/uploads/1/3/0/5/130590741/lufumifumonobamuk.pdf
    • http://seeinthedark.ca/uploads/1/3/0/5/130588288/1339196.pdf
    • http://marketingforgrinders.net/uploads/1/3/0/3/130313069/wesunekupune.pdf
    • http://durafria.net/uploads/1/3/0/7/130740082/fukebivuguzirob_zatarosoliken_semarivu.pdf
    • http://bachatainlosangeles.com/uploads/1/3/1/1/131164113/7038698.pdf
    • http://sharper-point.com/uploads/1/3/0/3/130379298/5255679.pdf
    • http://trilbyretreat.com/uploads/1/3/0/7/130738924/fitujufajab.pdf
    • http://k-statebasketballplayers.net/uploads/1/3/0/7/130739505/duripakuja.pdf
    • http://alex-kwon.com/uploads/1/3/1/3/131379550/2301496.pdf
    • http://kelleycarney.com/uploads/1/3/0/2/130287815/vorugugupewoke_nidolepege.pdf
    • http://eds.company/uploads/1/3/1/3/131383767/dd05ae7b1ff3.pdf
    • http://hasaicogroup.com/uploads/1/3/0/7/130775817/ruvuzepabad.pdf
    • http://mazzawidentalintown.net/uploads/1/3/0/6/130603842/8346864.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007449.bin
98c76025c9094e06e6162f8da9de1dc2ad60e88bb5449c97e16396265bb92cda		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7449 9308 bytes
font_01_sfnt_off0000955c.bin
e1440c4276d9e70b7e1adffed69c3d79964678c0be5cb655c6639e1573955a8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x955C 4128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.