Malicious PDF — malware analysis report

Static analysis result for SHA-256 b281c1cb6ecbeb1e…

MALICIOUS

PDF

49.8 KB Created: 2020-03-30 22:44:53 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 004623434e302740288669ed09c1cd95 SHA-1: 557d84b4323e8556779c0e9e725df5ee54d1652e SHA-256: b281c1cb6ecbeb1e114de5c052d338b022c10e099e1c87f436ce0d0c848ec166
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links, a technique commonly used for SEO poisoning or to redirect users to malicious sites. The document body mentions a recipe, likely a lure to disguise the malicious intent. The PDF_SEO_LINK_FARM heuristic firing confirms the presence of a mass external link farm, indicating a high likelihood of malicious redirection. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://connectingtocommoncore.com/uploads/1/3/0/7/130775743/130775743.html#dunkin+donuts+vanilla+chai+copycat+recipe
    • http://kotasolutions.net/uploads/1/3/0/8/130813649/ca4df55f14a3.pdf
    • http://barberderekrocks.com/uploads/1/3/0/4/130478772/9a7fbc196492.pdf
    • http://ridleystallingsrealestate.com/uploads/1/3/1/3/131383652/80a0575f.pdf
    • http://thestandguild.com/uploads/1/3/0/9/130969921/2161845.pdf
    • http://alogoclub.com/uploads/1/3/0/9/130969336/84590.pdf
    • http://kaylapishnak.com/uploads/1/3/1/0/131071063/gepuxok-laran.pdf
    • http://118erotica.com/uploads/1/3/0/5/130589080/7cb52.pdf
    • http://lovecoastalcottage.com/uploads/1/3/0/8/130873781/zumegapu-sasigixemebi-jekeweva.pdf
    • http://nanlaird.com/uploads/1/3/1/0/131069887/niwunozebewofatu.pdf
    • http://sarahallcleaning.com/uploads/1/3/0/5/130589132/375311.pdf
    • http://nlightnstudio.com/uploads/1/3/1/3/131383982/xibowez.pdf
    • http://zenyasastudio.com/uploads/1/3/0/7/130738569/0850cdfe0d3e236.pdf
    • http://therestylers.com/uploads/1/3/0/6/130621780/zibigogadilaletixov.pdf
    • http://natashagrover204.com/uploads/1/3/1/4/131408343/zivuvawesofilej.pdf
    • http://ourdifferencesdetermine.com/uploads/1/3/0/2/130289796/55f62.pdf
    • http://joejordanart.com/uploads/1/3/0/7/130738507/bowulozav.pdf
    • http://traveljester.com/uploads/1/3/0/3/130313673/tedagaxenedevizuk.pdf
    • http://autoglassgrapevinetx.com/uploads/1/3/0/3/130323100/dasef_fesujokululoga_xomulogumigeka.pdf
    • http://laendurance.net/uploads/1/3/0/6/130603858/92ef61b468.pdf
    • http://tt19server.com/uploads/1/3/0/9/130969510/10d23ac3fef.pdf
    • http://floden.dk/uploads/1/3/0/5/130588856/d41b64e6346e65b.pdf
    • http://aftrd.org/uploads/1/3/1/4/131453530/puderera_tonobaziwudapa.pdf
    • http://hecuba.co/uploads/1/3/0/3/130313057/difuxonovazevifixa.pdf
    • http://cbfashionboutique.com/uploads/1/3/0/5/130547069/8140701.pdf
    • http://barkingoven.com/uploads/1/3/0/4/130491444/dojike-rixoxelubuturux.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007ff2.bin
b6a4731d4828562e7a9c4a6d1f04c7e2ccc0108ca8ddcaf94311ad39a734ecc8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FF2 8628 bytes
font_01_sfnt_off0000a11f.bin
1d1fa5121415f8f5353993473374918b9d2a38f433752094af4cce5d3be72c8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA11F 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.