Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf792e019de9fe99…

MALICIOUS

PDF

42.0 KB Created: 2020-04-02 01:11:14 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9756586bf34f67f1167825a2c3cc8f28 SHA-1: 97d7178cd571bf9c457ccb21170a1fa1f9352f69 SHA-256: bf792e019de9fe99e14162e1c3e4199c8148cd74d5bc882be1b9d88ee4193e19
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The ML classifier also strongly indicated maliciousness. The document body contains garbled text and a URL, reinforcing the idea that the primary purpose is to direct users to external, potentially malicious, content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pameladirnberger.com/uploads/1/3/1/4/131454024/131454024.html#paradas+del+metrobus+puebla+linea+1
    • http://bebeautyskincare.com/uploads/1/3/0/7/130739532/d02f99018d79391.pdf
    • http://technofreesundays.com/uploads/1/3/0/9/130969938/nukuxivezus-jofenibuler-lodakubafu.pdf
    • http://littleredrecipes.com/uploads/1/3/0/3/130313183/cdba5cbbd35.pdf
    • http://newyoujewelryshop.com/uploads/1/3/0/2/130272571/2172050.pdf
    • http://zipganizer.net/uploads/1/3/0/7/130775465/52c3734e5d.pdf
    • http://smcapgroup.com/uploads/1/3/0/4/130436258/batiga.pdf
    • http://defacebooktraining.genpromotion.nl/uploads/1/3/0/6/130605283/binoxejin.pdf
    • http://sakilelyles.com/uploads/1/3/0/4/130489423/7f5ff97ead2562.pdf
    • http://coffeeandsmirks.com/uploads/1/3/0/5/130543074/43c292c856d8e3.pdf
    • http://bridesewbeautiful.org/uploads/1/3/0/9/130969829/wamenekifaba-pifivilodumukad-bijapifuvubi.pdf
    • http://dutchmansound.com/uploads/1/3/1/4/131406809/puvadeb_bofageradawo_watilixufikoreg_jedapej.pdf
    • http://okiedesign.net/uploads/1/3/0/7/130775048/3178540.pdf
    • http://potisthenewcoffee.net/uploads/1/3/0/8/130874210/tizatewi.pdf
    • http://hanaabeautyandnailsshop.com/uploads/1/3/0/5/130547884/guvabuva.pdf
    • http://orepto.org/uploads/1/3/0/7/130739962/e0e7730b.pdf
    • http://proficientorganizing.com/uploads/1/3/0/6/130605403/vigifimevize.pdf
    • http://fromelsewhere.agency/uploads/1/3/0/5/130538995/ecfc614fbf.pdf
    • http://mosaichomedecor.org/uploads/1/3/0/5/130588213/6874232.pdf
    • http://thepadremotel.com/uploads/1/3/0/8/130814923/2050767.pdf
    • http://ronsloycfp.com/uploads/1/3/0/5/130588934/tuzuwixig_pofeputa_modebutasepaz_zemuwawa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007853.bin
cbfc4f61fefdcb333bbf30a6e0e83f2e9cf164d12e4566d80526d5a890c7ebc2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7853 8888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.