Malicious PDF — malware analysis report

Static analysis result for SHA-256 a60fca36ec8955ff…

MALICIOUS

PDF

18.9 KB Created: 2020-04-01 17:33:33 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 02da5ae1104026b996e7de20299b0a41 SHA-1: 05004d950d2c137a2d907966a06bd4d1ec4b3d71 SHA-256: a60fca36ec8955ff93a136b17c3bef0bb2848d1167f6f783393a67ad016e8bde
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF is identified as an image-only lure, typical of phishing campaigns. It contains numerous external links, with the primary one pointing to a suspicious HTML file. The ML classifier strongly indicates maliciousness. No scripts were extracted, but the structure and link farm suggest a delivery mechanism for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 18 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://customartstores.com/uploads/1/3/0/2/130291884/130291884.html#constitucion+1812+articulos+mas+importantes
    • http://ckfacials.com/uploads/1/3/0/5/130551349/febodev.pdf
    • http://ngpsychology.com/uploads/1/3/0/2/130291579/pamabinavegiruka.pdf
    • http://thecountrybaker.com/uploads/1/3/1/4/131438473/22b55.pdf
    • http://lifelikeled.com/uploads/1/3/0/5/130539408/14ac470fff85202.pdf
    • http://ambservicesllc.org/uploads/1/3/0/7/130740617/6949229.pdf
    • http://magnumusa.net/uploads/1/3/0/6/130605498/226e6a2.pdf
    • http://striplingeducation508.org/uploads/1/3/1/3/131381675/fa68a.pdf
    • http://juanitagrahamsmith.com/uploads/1/3/1/1/131164318/8af641c.pdf
    • http://zeetadollhouse.com/uploads/1/3/1/0/131070227/ae4e315fdf12621.pdf
    • http://clevelandschoolofcannabis.com/uploads/1/3/0/4/130489527/xotir.pdf
    • http://miwoori.net/uploads/1/3/0/4/130483769/dasigijojur-sarixemube.pdf
    • http://dogfriendlyphx.com/uploads/1/3/0/8/130813369/lelik.pdf
    • http://fmstrategiesllc.com/uploads/1/3/0/7/130775364/93c01140c4b62.pdf
    • http://moimeme.studio/uploads/1/3/0/7/130740210/9406684.pdf
    • http://2liquidstore.com/uploads/1/3/0/6/130621355/zixaposiv.pdf
    • http://122corson.net/uploads/1/3/0/6/130639310/4898024.pdf
    • http://ponderosagundogs.com/uploads/1/3/0/5/130550830/gomulopufov.pdf
    • http://vittonezone.com/uploads/1/3/0/2/130271153/bogolumo-givix-rexulinik-kazutituv.pdf
    • http://cairnsclassictours.com/uploads/1/3/0/6/130604358/wopadusela_wiruzigir.pdf
    • http://maribundy.com/uploads/1/3/0/5/130540928/42091728af653a.pdf
    • http://politics4all.com/uploads/1/3/0/5/130588568/gikosijililiw.pdf
    • http://xclusivsalon.com/uploads/1/

Open this report in the interactive analyzer, or submit your own file for analysis.