Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba993eadc60b865c…

MALICIOUS

PDF

46.9 KB Created: 2020-03-28 04:08:23 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 00454a014e97f641bfec316ec65901a9 SHA-1: 55f0b6c11669d1fdee9d3c9d6229deb95f3f4afb SHA-256: ba993eadc60b865c494ee20334c3d24cda5374551f17885b3259036149f397c7
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The embedded document body text, while partially corrupted, includes a URL that points to a collection of PDF files. This suggests the primary purpose is to redirect users to a link farm, likely for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xocobean.com/uploads/1/3/0/2/130289746/130289746.html#prueba+de+hipotesis+estadistica+ejemplos+en+excel
    • http://www.whalestowags.com/uploads/1/3/0/9/130969449/zexukiworosibawefa.pdf
    • http://screenlo.com/uploads/1/3/0/5/130543588/9561761.pdf
    • http://cheytownlady.com/uploads/1/3/0/2/130271243/tutapizugolajezupik.pdf
    • http://naiobebrown.com/uploads/1/3/0/4/130483191/voxizap.pdf
    • http://luxurydaytona.com/uploads/1/3/0/7/130775200/4078012.pdf
    • http://a2zaccountants.org/uploads/1/3/0/5/130590436/tevejogudepurim-kizolu-xinemepapaj-dujisoxet.pdf
    • http://annapolismontessori.net/uploads/1/3/0/6/130604026/b730676ad564f.pdf
    • http://thefinalbow.com/uploads/1/3/0/7/130739112/polofet-zegudirewuliwuj-nixadisudonufu-mefikusa.pdf
    • http://connectumarriageministry.com/uploads/1/3/0/6/130604220/bigoju.pdf
    • http://ecofirewood.lt/uploads/1/3/0/5/130590279/tikinak.pdf
    • http://mommasnow.com/uploads/1/3/0/2/130288510/7717092.pdf
    • http://apexformulas.com/uploads/1/3/0/6/130604696/e3d7a8cf59.pdf
    • http://arihantoart.com/uploads/1/3/0/4/130488265/3ca760f12b6775.pdf
    • http://www.helpscottheal.com/uploads/1/3/0/4/130483869/9684316.pdf
    • http://howlettandco.com/uploads/1/3/0/4/130476574/9e7f5daeb17a6.pdf
    • http://spectrumlifecare.net/uploads/1/3/0/7/130739289/a11c0.pdf
    • http://www.mythinkando.com/uploads/1/3/0/5/130539416/tinovofezutizisu.pdf
    • http://newanday.host/uploads/1/3/0/6/130621282/pomijevoxu.pdf
    • http://viraven.com/uploads/1/3/0/4/130476738/4844307.pdf
    • http://www.creative-tech.ca/uploads/1/3/0/5/130539494/6001302.pdf
    • http://midlandsdetailer.com/uploads/1/3/0/4/130476976/5205e6b.pdf
    • http://ahacia.com/uploads/1/3/0/8/130813055/84b954a5d9.pdf
    • http://scotiarootstours.com/uploads/1/3/0/2/130274097/e6dada132e0dc.pdf
    • http://lindsayrosehealing.com/uploads/1/3/0/3/130379651/rugofowa-pojewepum-wifiwadepux-nalebapakudumuz.pdf
    • http://lindsayrosehealing.com/uploads/1/3/0/3/130379651/rugofowa-pojewepum-wifiwadepux-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077fa.bin
d653bae1d331fce76012cd62f2202a191dc8e784da62fc9919bb4563409f7183
pdf-font-stream PDF embedded font (sfnt) at offset 0x77FA 8952 bytes
font_01_sfnt_off0000966f.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
pdf-font-stream PDF embedded font (sfnt) at offset 0x966F 16036 bytes