Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb48a2f9ac3f1ffd…

MALICIOUS

PDF

69.2 KB Created: 2020-03-20 15:50:13 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 05af45949bce6db8a16146cd99af6680 SHA-1: e6889836915b9f1838c52b1bfbacb6688966ad97 SHA-256: bb48a2f9ac3f1ffdb0a4c79954d05e4ba17e7d440544155c5665f8f54300f7f4
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm or SEO spam technique, likely intended to drive traffic to malicious or low-reputation sites. The document body itself contains metadata related to its creation by wkhtmltopdf and a search query, suggesting it was generated to appear as a search result. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://f10athletics.com/uploads/1/3/0/7/130776585/130776585.html#dimensiones+del+aprendizaje+marzano+pdf
    • http://mamu.ca/uploads/1/3/0/8/130813510/ff8dc9bd983a.pdf
    • http://synergyelitekratom.com/uploads/1/3/0/3/130313557/50e00a7b8c5.pdf
    • http://legacy-thrift.com/uploads/1/3/1/0/131070938/vegibekaji_kasug_madiralono_lomutiz.pdf
    • http://easlinstitute.org/uploads/1/3/0/6/130639852/ef4a7b486d5a.pdf
    • http://campbellslittleloads.com/uploads/1/3/0/5/130541103/e8e4601.pdf
    • http://carlpires.com/uploads/1/3/0/6/130604336/mobipebigiro-wijidulomo-xisabodewu.pdf
    • http://adrianoconnor.com/uploads/1/3/0/5/130588511/gusaninemazidado.pdf
    • http://spartanssouthlafc.org/uploads/1/3/0/5/130543064/4049961.pdf
    • http://orangecountybestpressurewashing.com/uploads/1/3/0/6/130604612/jigibivov.pdf
    • http://ebdoproperties.com/uploads/1/3/0/6/130605122/1055425.pdf
    • http://brandranker.com/uploads/1/3/0/8/130874366/2cd6e1653.pdf
    • http://beccaandbill.com/uploads/1/3/0/7/130739143/1978827.pdf
    • http://321markets.com/uploads/1/3/0/6/130604640/modezuwijipa.pdf
    • http://ashleyberendphotography.com/uploads/1/3/0/4/130483474/jaxagilixov_zerokivo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e431.bin
82444918342f0469cbe282d7a51f7c1be8f4f2fb64fc501f2e73b13485f791ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE431 9288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.