Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad0178b3723fded2…

MALICIOUS

PDF

32.4 KB Created: 2020-05-14 05:52:49 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b0291a2cd5e17ba1f92d72738d94f157 SHA-1: 6b5236b91ed3dfc1b291f92b4cf7ebe04462f55c SHA-256: ad0178b3723fded224fe8e7da3d72f288f0997950ef798d9077e871612172c94
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of external links, many of which point to other PDF files on different domains. This behavior is indicative of a link farm or SEO manipulation tactic, potentially used to distribute malicious content or improve search engine rankings for malicious sites. The ML classifier strongly flagged this PDF as malicious, supporting the suspicious nature of the link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://homestagingprofessionaltraining.com/uploads/1/3/0/5/130551750/130551750.html#administracion+de+recursos+humanos+pdf+17+edicion
    • http://ecplusllc.com/uploads/1/3/1/1/131164128/6928822.pdf
    • http://briaswaringam.com/uploads/1/3/0/7/130775376/178103e6926.pdf
    • http://embodiedkama.org/uploads/1/3/0/6/130639155/navebunupoz_dirimupetif.pdf
    • http://impactkitchenandbath.net/uploads/1/3/0/7/130775465/0bfce.pdf
    • http://kingdomlawncare.org/uploads/1/3/0/4/130436242/26d47.pdf
    • http://luxhout.com/uploads/1/3/0/8/130874265/6385013.pdf
    • http://freewheelcyclesma.com/uploads/1/3/0/6/130604169/puzeliti.pdf
    • http://viewsxvibes.com/uploads/1/3/0/6/130639463/5751cd2450e9.pdf
    • http://bizibook.net/uploads/1/3/0/7/130739288/8417014.pdf
    • http://cwbeachbums.com/uploads/1/3/0/7/130739254/wopaguginedit-vadanobo-meretitiwisub.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000051a9.bin
f8fb3be93a51906dc1a1bad6fd28aee0504f9049a967851ebe4757e598c502a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51A9 10736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.