Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9b313864f9a04a6…

MALICIOUS

PDF

95.7 KB Created: 2020-06-06 04:51:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c303ccb3e81aead6b86324bc53dc340a SHA-1: 754b087728197e8b992af92f1c54ce7795f1aafc SHA-256: a9b313864f9a04a6abde0bdbccb231667243aa2b36c20da2d513a75a41e24282
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to seemingly unrelated PDF files on various domains. This behavior is indicative of a link farm or SEO manipulation tactic. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains text related to a technical manual, likely used as a lure to encourage clicks on the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://danceartsofcentralnj.com/uploads/1/3/0/6/130639689/130639689.html#manual+of+steel+construction+allowable+stress+design+9th+edition
    • http://lpcares.com/uploads/1/3/1/4/131437612/17fcc9b.pdf
    • http://emilianoevaleria.com/uploads/1/3/1/3/131383959/binutaxe.pdf
    • http://diehlsonwheels.com/uploads/1/3/0/5/130542865/mopidugexuvig_durobatinavodu_xafanipofox_gajulenari.pdf
    • http://boschgistics.com/uploads/1/3/0/6/130621315/baxorawemuferin-jewapujijus-bipugadelufusul.pdf
    • http://shskidsonline.com/uploads/1/3/0/2/130289630/xarenasegi-putaremafodex-teneg-nevojud.pdf
    • http://muldoondiesel.com/uploads/1/3/0/8/130813778/jikovivo_fatab.pdf
    • http://eastnobletrack.com/uploads/1/3/1/4/131453046/vojoxetuxa.pdf
    • http://tagwalk-creative.com/uploads/1/3/1/6/131637464/5631773.pdf
    • http://localhalalcuisines.com/uploads/1/3/0/8/130874150/711774.pdf
    • http://danceartsofcentralnj.com/uploads/1/3/0/6/130639689/terms.html
    • http://danceartsofcentralnj.com/uploads/1/3/0/6/130639689/dmca.html
    • http://danceartsofcentralnj.com/uploads/1/3/0/6/130639689/policy.html
    • https://sibuvajez.files.wordpress.com/2020/06/44042216616.pdf
    • https://fopolulapipu.files.wordpress.com/2020/06/xenataduwifikaf.pdf
    • https://tamofudugeso.files.wordpress.com/2020/06/32547888216.pdf
    • https://pinajamo.files.wordpress.com/2020/06/kipomepofetup.pdf
    • https://ridarenujo.files.wordpress.com/2020/06/bunizipum.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012f34.bin
a4fe1f3b1f76c83c03e84d9d3c1fd7781e05bbee391846ee4f0b90ab74b6c192		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F34 13076 bytes
font_01_sfnt_off00015a4f.bin
f948f077d88e4849ea508066c7392ad1a0826e0200fc3f4722afc08ccc88c106		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15A4F 16720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.