Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa68b29b4e6222f8…

MALICIOUS

PDF

18.7 KB Created: 2020-04-05 08:07:56 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 26394436e8780ce8d1e18a590b58df92 SHA-1: 2465e4c439b81dc965417d1c6d237ff07c9a51d6 SHA-256: aa68b29b4e6222f8cfa5133e32ed6b55d557d48613375a12f6c6cf8a1f6e7971
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document is identified as malicious by an ML classifier and exhibits characteristics of a phishing lure, including an image-only design and embedded external links. The heuristic 'PDF_IMAGE_LURE' indicates a screenshot lure, suggesting the user is expected to click a link to proceed. The numerous embedded URLs, such as http://metdekroofing.com/uploads/1/3/0/4/130476732/130476732.html#metallica+nothing+else+matters+lyrics+poster and http://cydanceintensive.com/uploads/1/3/0/7/130775977/ragopovozinukuji.pdf, likely lead to malicious content or further infection vectors.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 18 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://metdekroofing.com/uploads/1/3/0/4/130476732/130476732.html#metallica+nothing+else+matters+lyrics+poster
    • http://cydanceintensive.com/uploads/1/3/0/7/130775977/ragopovozinukuji.pdf
    • http://goldcreektennissports.com/uploads/1/3/0/2/130272955/3761963.pdf
    • http://weiwu1214.com/uploads/1/3/0/9/130969983/xoburomuwuburulag.pdf
    • http://bridgingthegapproperties.net/uploads/1/3/0/5/130551543/milutow_fugovakisusugur.pdf
    • http://onestoprenovating.com/uploads/1/3/0/3/130379169/bipesapunigimux.pdf
    • http://darklordflaglo.ca/uploads/1/3/1/4/131437593/129cb44c.pdf
    • http://thebriefrelief.com/uploads/1/3/0/4/130478123/074fe79e6350.pdf
    • http://jota2fotografia.com/uploads/1/3/0/4/130476043/5883666.pdf
    • http://greenwayprime.com/uploads/1/3/1/0/131070656/batetuwarewi.pdf
    • http://ginasenini.com/uploads/1/3/0/2/130289184/vedidonirubejebolip.pdf
    • http://blaircmc.com/uploads/1/3/0/5/130588554/666f1edbc431b.pdf
    • http://kellyjoboyd.com/uploads/1/3/0/7/130739894/296f2e53ea8800.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.