Malicious PDF — malware analysis report

Static analysis result for SHA-256 c35ea5a2f4e38109…

MALICIOUS

PDF

40.0 KB Created: 2020-04-02 04:32:17 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b001808768d4031715e16b48b909d54f SHA-1: b71210827a378739ecace0ecc401d1dd859c35f7 SHA-256: c35ea5a2f4e38109b5bd80a2ada393b37750a8c8deb037fd2ff18021e91e5c77
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or distribution mechanism. The ML_NYX_PDF_MALICIOUS heuristic also strongly indicates malicious intent. No scripts were extracted from this sample, but the extensive link farm points towards a malicious distribution or SEO poisoning campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://floweroflife.in/uploads/1/3/0/3/130313358/130313358.html#i+ching+hexagram+32
    • http://suzanneshirley.com/uploads/1/3/0/9/130969329/siraki.pdf
    • http://thevaughnrealestategroup.net/uploads/1/3/0/2/130270945/tolufobolokeso-taputetavepe.pdf
    • http://timobrienfortrustee.ca/uploads/1/3/1/1/131163983/9e7101308d.pdf
    • http://katharicleaningservicesllc.com/uploads/1/3/0/8/130813307/visexasobe-dumiverulasume-dozow.pdf
    • http://thelivingwordchannel.com/uploads/1/3/0/8/130813554/c3a55c.pdf
    • http://kweliteokc.com/uploads/1/3/0/2/130272365/6746431.pdf
    • http://theblackduckstudios.com/uploads/1/3/0/5/130540046/4781409.pdf
    • http://freetelwireless.com/uploads/1/3/0/7/130774993/polavoredinub_lokanirakenuf.pdf
    • http://harnessthepowerofhydrogen.com/uploads/1/3/0/4/130436095/6b8c6c.pdf
    • http://oncologypsych.net/uploads/1/3/0/5/130539309/2048346.pdf
    • http://lynneafreeman.com/uploads/1/3/0/5/130551309/5552781.pdf
    • http://rayschatz.com/uploads/1/3/0/4/130483295/1504140.pdf
    • http://kidswego.com/uploads/1/3/0/7/130739254/fabaxazi_fopewanoropaw_rarisimegat_falimonos.pdf
    • http://astoneofonesown.com/uploads/1/3/1/4/131438783/waxiv.pdf
    • http://exolus.com/uploads/1/3/0/4/130490561/3653476.pdf
    • http://jaimielindsay.com/uploads/1/3/0/6/130604905/popowo_nikubomipimarup_jegudo_vuwipu.pdf
    • http://wowsocial.net/uploads/1/3/0/4/130436318/46ddbdc00d6bd.pdf
    • http://foundationslearningacademy.org/uploads/1/3/1/0/131070933/lonizunolewezi.pdf
    • http://hotelkalaja.net/uploads/1/3/0/5/130588570/2792989.pdf
    • http://mydancecourses.com/uploads/1/3/0/9/130969048/ae08c.pdf
    • http://marymacken.com/uploads/1/3/0/2/130289797/0fb8ed.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007781.bin
90984da43a5fbf4428a19fc34cf21c720978bd6e7a4ec08dd108f0b26dddadfe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7781 8132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.