Malicious PDF — malware analysis report

Static analysis result for SHA-256 abbd61590857a485…

MALICIOUS

PDF

41.2 KB Created: 2020-04-03 13:46:57 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 05d02b9c5a3815702c50479d2c8a42fc SHA-1: d95944c92fe9c768e0a057f4dfdd1a94814f9c21 SHA-256: abbd61590857a48571aff8d06486c73adc305c6f832294b8bb58a943b8835eae
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDFs on different domains. This pattern is indicative of a link farm or traffic distribution network. The ML classifier strongly suggests maliciousness, and the presence of numerous SEO-like URLs supports the conclusion that this document is part of a malicious campaign, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vinceaaland.com/uploads/1/3/0/8/130814248/130814248.html#oraciones+subordinadas+sustantivas+con+funcion+de+sujeto+ejemplos
    • http://lowmanengineering.com/uploads/1/3/0/6/130620899/pasozetedufo_bosariw_tepelajadukisum_dodagazakuv.pdf
    • http://smartasstrologer.com/uploads/1/3/0/3/130313155/buwape.pdf
    • http://thehangaruk.co.uk/uploads/1/3/0/6/130604133/lobusedabikid_fodudapiwim_xagezotezod_vexijaze.pdf
    • http://andrewstephwed.com/uploads/1/3/0/6/130605112/f14e2df7f.pdf
    • http://colinaway.com/uploads/1/3/1/0/131070302/bb508695f4f.pdf
    • http://jwsolutionsgroup.com/uploads/1/3/0/9/130969283/ditoj.pdf
    • http://swflharmonychamber.org/uploads/1/3/0/5/130551338/japexumod.pdf
    • http://eaarmada.com/uploads/1/3/1/3/131384714/berizajumunanab_pevaguwifupator.pdf
    • http://shuffledelements.com/uploads/1/3/0/7/130776888/d6f3923fbbd63.pdf
    • http://bhelandscaping.com/uploads/1/3/0/4/130436483/nexet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007754.bin
c69259c807b7cd4041a5a69427aa62f082fe4f26bd4e147a3592afa19108d570		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7754 8152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.