Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac519aca5939c2aa…

MALICIOUS

PDF

16.9 KB Created: 2020-07-03 01:49:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b2b146589f1b9aed97e9cf8bbf97b2c3 SHA-1: e66f4b4ccfdc491be0aceca0cc8634e02ca97434 SHA-256: ac519aca5939c2aa2a9e5648b130b5f60dda496fdc5cccdecfc315fa381f1dd9
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link

The PDF employs an image-only lure, typical of phishing, to entice users to click on embedded links. The document contains a large farm of external PDF links, suggesting a potential SEO poisoning campaign or a distribution point for further malicious content. The ML classifier strongly indicates maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://files.alamohhcandh.org/uploads/1/3/2/7/132741482/132741482.html#en+la+ardiente+oscuridad+english+pdf
    • http://maestrovincenzo.net/uploads/1/3/0/2/130287401/nudanom.pdf
    • http://files.shammaslab.com/uploads/1/3/1/4/131437443/d9ba51438.pdf
    • http://paulinemaccay.com/uploads/1/3/0/4/130476760/xomidoxo.pdf
    • http://files.mdfoodtrucks.com/uploads/1/3/0/8/130813084/donetigezizugo.pdf
    • http://files.troop75.org/uploads/1/3/0/5/130589184/6483521.pdf
    • http://files.kimsheavenlyblingbash.com/uploads/1/3/1/4/131438323/7a8f5c37b535.pdf
    • http://dedicated-22.pleasingfood.com/uploads/1/3/0/3/130323213/6f18575.pdf
    • http://galapagoknives.com/uploads/1/3/0/6/130604233/c130bebd6.pdf
    • http://files.walk-cards.com/uploads/1/3/0/6/130639860/6675452.pdf
    • http://fozzieofficial.com/uploads/1/3/1/0/131071183/1679073.pdf
    • http://cielet.org/uploads/1/3/0/7/130740080/defokikezinaz.pdf
    • https://bilebapajaji.files.wordpress.com/2020/06/49857382098.pdf
    • https://lizumiso.files.wordpress.com/2020/06/69340352432.pdf
    • https://xazozosemo.files.wordpress.com/2020/06/69063354323.pdf
    • https://patepiborev.files.wordpress.com/2020/06/kipopotugejoto.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.