Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1a512b4a0f97b78…

MALICIOUS

PDF

28.6 KB Created: 2020-04-16 14:13:10 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 36448477d7c97d93992bf8e0a0dbba26 SHA-1: 59d43705d104e7d5a8323f66416dc117a6ce32cb SHA-256: c1a512b4a0f97b780e591023088123f3c672744d339c69f73bc75d8bb10715a8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure document disguised as a 'Compound sentence worksheet 8th grade'. It embeds a large number of external links, forming a link farm, which is a common technique for SEO poisoning and driving traffic to malicious sites. The primary heuristic indicates a PDF URI pointing to a specific HTML page, while another critical heuristic flags a mass external PDF link farm. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kmaysphotography.com/uploads/1/3/1/6/131637483/131637483.html#compound+sentence+worksheet+8th+grade
    • http://alliancedirecte.ca/uploads/1/3/0/7/130776564/dd60fb03.pdf
    • http://kennebunkportbedandbreakfast.com/uploads/1/3/1/3/131380351/5225448.pdf
    • http://scifilms.co.nz/uploads/1/3/0/7/130739445/00fde794736.pdf
    • http://www.lizzyandmike.com/uploads/1/3/0/8/130813461/gamevik_fanulabuda.pdf
    • http://bertienkok.nl/uploads/1/3/0/8/130874050/f3128af9a79.pdf
    • http://musicwithjojo.com/uploads/1/3/0/4/130483368/9446662.pdf
    • http://trufflesliving.com/uploads/1/3/1/3/131398246/riwataxejol_jegasonudise.pdf
    • http://pnfccwi.com/uploads/1/3/0/7/130739260/491202.pdf
    • http://sheezastatement.com/uploads/1/3/1/4/131406999/747958.pdf
    • http://abgymcr.com/uploads/1/3/1/4/131438086/jadamonuwuwup.pdf
    • http://2liquidstore.com/uploads/1/3/0/7/130775727/0cc253013d79c.pdf
    • http://laendurance.net/uploads/1/3/0/2/130289668/f5e8e902a9d.pdf
    • http://davewatersvoiceovers.com/uploads/1/3/0/4/130476733/3190696.pdf
    • http://housetagger.com/uploads/1/3/0/2/130289638/db1d01eed3.pdf
    • http://lampionterbang.net/uploads/1/3/0/5/130540926/bigoziluvuba.pdf
    • http://sheezastat

Open this report in the interactive analyzer, or submit your own file for analysis.