Malicious PDF — malware analysis report

Static analysis result for SHA-256 b510075c2e2448c0…

MALICIOUS

PDF

42.8 KB Created: 2020-04-01 16:53:58 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9ba49d3963bf2c8bfccd6586b2d92cbf SHA-1: 1b6ab32cbefcfc595d56bb3bf2638f7955351477 SHA-256: b510075c2e2448c0d6950a375df0f0712dae5596c6e2642c7a09e40a4f93c473
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDF files on different domains, indicating a link farm or SEO abuse tactic. The document body text, while containing a seemingly innocuous title "Canciones para serenata con mariachi", is heavily obfuscated and likely serves as a lure. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://severinemillet.com/uploads/1/3/0/6/130639837/130639837.html#canciones+para+serenata+con+mariachi
    • http://deadbeatpress.com/uploads/1/3/0/5/130539783/lasivu-nozibiv.pdf
    • http://root-discovery.org/uploads/1/3/0/5/130539113/cb16dd76068.pdf
    • http://georgopoulos-books.com/uploads/1/3/0/3/130313069/vafesek.pdf
    • http://swingstatestories.com/uploads/1/3/0/3/130313037/974f89c3bad.pdf
    • http://justinjensenmedia.com/uploads/1/3/1/3/131398428/cd5bdbebc68.pdf
    • http://northernadventure.org/uploads/1/3/0/3/130379391/fupifekosejet.pdf
    • http://lafinancieredupatrimoine.com/uploads/1/3/0/7/130739945/8018815.pdf
    • http://ratzonmd.com/uploads/1/3/0/5/130589189/xuxabew_pebidani.pdf
    • http://oceania-business.com/uploads/1/3/0/2/130287878/fagidadelanid-lolufexe-kuguz.pdf
    • http://philipjbruce.com/uploads/1/3/0/4/130488228/6105b.pdf
    • http://aceaccounting-tricities.com/uploads/1/3/0/8/130814597/tidoxaxurusugib.pdf
    • http://bacalandersengarrison.com/uploads/1/3/0/7/130739088/bapavufaga.pdf
    • http://submitresume.club/uploads/1/3/1/0/131070293/1879169.pdf
    • http://eetiklekkerwel.nl/uploads/1/3/0/6/130639896/daziwigoro.pdf
    • http://benniebens.com/uploads/1/3/0/6/130620406/fanewa_mipob.pdf
    • http://primrosestudio.com/uploads/1/3/0/4/130477036/1926000.pdf
    • http://flyhighleadershipcouncil.com/uploads/1/3/0/8/130874065/vusujokawesar.pdf
    • http://airstrikeelite.com/uploads/1/3/0/6/130620614/jowimobeganemet-putugukavizasa.pdf
    • http://concretesolutionsofoklahomacity.com/uploads/1/3/0/4/130476976/latoku_kixux.pdf
    • http://applausehotel.org/uploads/1/3/1/3/131383352/lizusob-xudiromi.pdf
    • http://sjcraigfencing.com/uploads/1/3/0/5/130545128/bigokokezalileva.pdf
    • http://thesouthernshell.com/uploads/1/3/0/8/130813819/xulodowajuzaxerur.pdf
    • http://battlegroundfunctionalperformance.com/uploads/1/3/0/7/130776827/992638221770.pdf
    • http://renegadetradingcompany.com/uploads/1/3/0/9/130969559/negajovoj.pdf
    • http://2tallgals.com/uploads/1/3/0/5/130551050/b1acd5d498f4b03.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007cbf.bin
6b536c07d05c33f42391c1d1658047223eb73dac2f5eb842bc7d583f46507c14		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CBF 8896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.