Malicious PDF — malware analysis report

Static analysis result for SHA-256 af24e77af125dc2d…

MALICIOUS

PDF

18.8 KB Created: 2020-03-28 10:24:34 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ebe6fa5112352e072cd824d5e1020a28 SHA-1: 09f178587e251355c88d4f4e3b006d73ebbd5d37 SHA-256: af24e77af125dc2dd333cd9d524a3cf05238c5a45aa1476b5aa34bc76feecf3f
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF is identified as a malicious lure, likely intended to trick users into clicking through to external content. The document body and heuristics indicate it contains a large farm of links to other PDF files hosted across numerous domains, suggesting a SEO poisoning or link-farming tactic to drive traffic or distribute further malicious content. No scripts were extracted, and the primary malicious behavior observed is the extensive link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 18 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://inhalestillness.com/uploads/1/3/0/3/130323585/130323585.html#descargar+resucito+cantos+del+camino+neocatecumenal+pdf
    • http://www.visitors-insurance.dadgifts.us/uploads/1/3/0/6/130604778/8386407.pdf
    • http://mlmbigmoney.com/uploads/1/3/0/8/130813025/gifetewenarob-jexosowakawe-wezidiwebij.pdf
    • http://www.gentletouchenergy.com/uploads/1/3/0/2/130270738/cd7b5a3f.pdf
    • http://www.traceyhemp.co.uk/uploads/1/3/0/7/130740510/8504271.pdf
    • http://www.valuemanifesto.org/uploads/1/3/0/7/130739573/6596718.pdf
    • http://cartcootiecovers.com/uploads/1/3/0/6/130620670/zatubaze.pdf
    • http://morganmadisonlyons.com/uploads/1/3/0/8/130813042/kojudo.pdf
    • http://ivyadvance.net/uploads/1/3/0/6/130621782/forow.pdf
    • http://mychamberofsecretss.com/uploads/1/3/0/6/130639155/7280556.pdf
    • http://avretoday.com/uploads/1/3/0/5/130550660/709c70.pdf
    • http://alohawraps.co/uploads/1/3/0/5/130539048/vogivemiro_xilona.pdf
    • http://bbeboutiquellc.com/uploads/1/3/0/5/130545493/49248.pdf
    • http://access-17.com/uploads/1/3/0/4/130436250/jebij_barez.pdf
    • http://theoatmealpan.com/uploads/1/3/0/3/130323253/dakar.pdf
    • http://www.rockwallhvacrepair.com/uploads/1/3/0/6/130603785/6235201.pdf
    • http://choptallybarber.shop/uploads/1/3/0/5/130551206/418181.pdf
    • http://agsprime.com/uploads/1/3/0/6/130639630/6516477.pdf
    • http://host87.carmichaelnl.com/uploads/1/3/0/7/130776230/180977.pdf
    • http://www.lumcraft.net/uploads/1/3/0/6/130640070/zoxosizesifizonoloki.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.