Malicious PDF — malware analysis report

Static analysis result for SHA-256 b619a81b2ecda61e…

MALICIOUS

PDF

19.6 KB Created: 2020-05-24 01:15:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9d59050bd8f6a62f4b93b90fb7473e00 SHA-1: 74fe5d0a7712880cfeb7a553aeb5d0c62c80ea9b SHA-256: b619a81b2ecda61e5a170d607ca3082e0fb2620a253ccfbd51c6e89bbbe72c5f
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document is identified as a screenshot lure, containing minimal text and a single image, designed to trick users into clicking an external link. The document body contains multiple embedded URLs, with the primary one being http://zuihaozhuandeqipaiyouxi.br3h.com/uploads/1/3/0/3/130379411/130379411.html#solex+2200+fiche+technique. The presence of a large number of external PDF links on various domains suggests a link farm or SEO poisoning tactic to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9972

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 19 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zuihaozhuandeqipaiyouxi.br3h.com/uploads/1/3/0/3/130379411/130379411.html#solex+2200+fiche+technique
    • http://beyondthesport.org/uploads/1/3/1/0/131070530/monef.pdf
    • http://cayexclusive.com/uploads/1/3/1/4/131406285/d71d3eaa266e17.pdf
    • http://jwdimmage.com/uploads/1/3/1/3/131398148/tulewetolanole.pdf
    • http://lakeshoreproduce.com/uploads/1/3/0/5/130588494/dazil.pdf
    • http://scottandrobson.com/uploads/1/3/0/5/130551727/kekikufimige.pdf
    • http://e3motors.net/uploads/1/3/0/2/130289676/4532db1d.pdf
    • http://bodeaviation.com/uploads/1/3/1/8/131857435/1058860.pdf
    • http://rent-a-ringer.com/uploads/1/3/0/3/130323293/teletino-wumolapadubipew.pdf
    • http://myadventuresintravel.com/uploads/1/3/0/5/130588230/62063.pdf
    • http://hostmaster.wiekerutgers.com/uploads/1/3/0/7/130740349/mexigewafuzaruv-pepawumus-tadikenorijamo.pdf
    • http://phillipsspecialtycontractor.com/uploads/1/3/1/8/131872017/467608.pdf
    • http://psgn.no/uploads/1/3/0/9/130969118/a3a34a7d5e.pdf
    • http://happyorangutan.net/uploads/1/3/0/9/130969895/d0a11215251f37.pdf
    • http://dlgicefactory.com/uploads/1/3/0/5/130588191/sisurevisesufes-vonob-jedaj.pdf
    • http://mirrorimageceramicdetailing.com/uploads/1/3/0/6/130620429/gudufolavuxag.pdf
    • http://mhmotter.com/uploads/1/3/0/5/130551214/668cd0fa63cdef1.pdf
    • http://gracefullygorgeous.team/uploads/1/3/1/4/131406800/ligazoleniketeg.pdf
    • http://smithbrownpress.org/uploads/1/3/0/5/130539109/18e102b90b842c1.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.