Malicious PDF — malware analysis report

Static analysis result for SHA-256 b875705c543e943d…

MALICIOUS

PDF

46.8 KB Created: 2020-05-19 00:14:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a19aad4da0cc823a544c94efea8af8dd SHA-1: 891d4a2fca4a953315b9b0f70cd3d44efe8b6cca SHA-256: b875705c543e943ddcc0015d32b8b72cdd057b469d0c10f638d9c7138c225f66
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

This PDF file was flagged as malicious by an ML classifier and contains a large number of external links, many of which point to other PDF files. The document body contains text related to 'The legend of korra turf wars part 3' and metadata indicating it was generated by wkhtmltopdf, suggesting a lure or SEO spam tactic. The primary attack pattern involves redirecting users to a vast network of linked PDFs, potentially for distributing malware or engaging in SEO abuse.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://browlashboutiqueny.com/uploads/1/3/0/5/130588407/130588407.html#the+legend+of+korra+turf+wars+part+3
    • http://emergebydesign.org/uploads/1/3/1/3/131383523/robisa.pdf
    • http://dancingravenstoneworks.com/uploads/1/3/1/8/131872000/a74bbe382fbd742.pdf
    • http://elizabethlyonsauthor.com/uploads/1/3/0/7/130739682/307953.pdf
    • http://socialpatois.com/uploads/1/3/1/3/131380087/zugof_perudalo_vejiromisap_xeramidogoko.pdf
    • http://switchmaas.com/uploads/1/3/1/6/131637109/b9bac27bd7cda.pdf
    • http://mountainsportandfitness.com/uploads/1/3/0/2/130287992/a50523993ad6.pdf
    • http://ironcountyfbfs.com/uploads/1/3/0/6/130620449/jolukadisa.pdf
    • http://florsnmore.com/uploads/1/3/0/2/130289205/2135474.pdf
    • http://connectedhomeuk.com/uploads/1/3/0/8/130874347/mipodagepasiwi.pdf
    • http://speechact.org/uploads/1/3/0/4/130435556/vezefo-jivoxerotiza-bezevisuzunovig-fedulijotagep.pdf
    • http://macsmart242.com/uploads/1/3/0/7/130738680/6979263.pdf
    • http://markusottomarwinzer.com/uploads/1/3/0/3/130323789/42731ee7fc.pdf
    • http://nccrew.com/uploads/1/3/0/2/130289460/2ea3f30.pdf
    • http://kirkleycommunications.com/uploads/1/3/0/5/130588426/c3338c8a1a5598.pdf
    • http://halefamilyrealestate.org/uploads/1/3/0/7/130776511/1350342.pdf
    • http://totalaccesssolutionsltd.com/uploads/1/3/0/4/130483219/d8dae6e698c9.pdf
    • http://accountantnet.com/uploads/1/3/1/0/131071253/gagatejewowarod.pdf
    • http://nordicmarine.online/uploads/1/3/0/5/130551668/joxewulijokoni_puwamilos_witilesel.pdf
    • http://bloombeautybridal.com/uploads/1/3/0/6/130604175/6065222.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008d77.bin
1c91625cdfe26989d8520b1a18ff6f6bd2745154a7359964b94747cb782a7cc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D77 10208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.