Malicious PDF — malware analysis report

Static analysis result for SHA-256 af787da968cfe80b…

MALICIOUS

PDF

30.0 KB Created: 2020-04-07 03:51:08 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9bad7a97ee2017b6141fb04369498829 SHA-1: 4b764912aff13c1fae0994ada92a33e7a2bf61e2 SHA-256: af787da968cfe80b5e05bc002e64da2cb14c013afb550ba85422b9393180a612
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files. The document body text, though partially corrupted, includes references to 'Ingersoll rand up6-50pe-125 manual', suggesting a lure to disguise the malicious intent. The primary heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to host further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sanfranciscopeacetreaty.org/uploads/1/3/0/5/130588512/130588512.html#ingersoll+rand+up6-50pe-125+manual
    • http://ifixifly.com/uploads/1/3/1/4/131407695/gesejaxidov.pdf
    • http://msmask-bareford.com/uploads/1/3/0/4/130489367/6df24640460d1a8.pdf
    • http://sginvestmentproperties.com/uploads/1/3/0/3/130379424/mevuseregavazu_tiravodu.pdf
    • http://encountermanagementsystem.com/uploads/1/3/0/3/130379653/3a002859c286.pdf
    • http://maryfairyguidance.me/uploads/1/3/0/3/130323332/zakafofe_latafe_jinifuzijevut_fobopesama.pdf
    • http://moonvald.com/uploads/1/3/1/0/131070216/zeburo.pdf
    • http://mcfarlandracing.com/uploads/1/3/0/4/130476359/fagofezavodibalero.pdf
    • http://boulevardcellars.com/uploads/1/3/0/4/130435518/bitagazexodana_lowefixipavo_mugagipolirej.pdf
    • http://bottomlessbrunchparties.com/uploads/1/3/0/2/130270812/sakatijupafowosome.pdf
    • http://sigillab.com/uploads/1/3/1/4/131407823/5975703.pdf
    • http://rogermcilroy.com/uploads/1/3/0/6/130639027/tekurudodevobaw_metuzovofiw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f3c.bin
3a8f0338d690ddf779c4ad1e5a357c38e03389ba4e213e7b29aae63394315b2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F3C 7136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.