Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3b2208a4cabf33e…

MALICIOUS

PDF

33.2 KB Created: 2020-03-29 10:53:16 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a08292e422d900c46477cebcb09b93a4 SHA-1: 5bbd696d03914a124433df7bca5191cb98a47155 SHA-256: c3b2208a4cabf33ebc87b5fccde33784696636b10175906b6efd6361c26dde68
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which are numerically or generically named and hosted on unrelated domains, indicating a link farm or SEO poisoning tactic. The document body, though corrupted, contains text referencing 'Twilight saga eclipse full movie 123' and a URL that mirrors this, suggesting a lure to illicit content. The primary malicious activity appears to be directing users to external, potentially malicious, URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-78-199.mgwnet.com/uploads/1/3/0/4/130483852/130483852.html#twilight+saga+eclipse+full+movie+123
    • http://convictkreations.com/uploads/1/3/1/3/131379274/gojonufixariguva.pdf
    • http://zazat.net/uploads/1/3/0/7/130738693/muzatumobejafinu.pdf
    • http://hotelbuyouts.com/uploads/1/3/0/8/130874493/xotokabunijezal-susefi.pdf
    • http://www.molliemoptoppers.com/uploads/1/3/0/5/130540746/soratavexiju.pdf
    • http://jesseisilvaphotography.com/uploads/1/3/0/3/130313405/6865e530cedb.pdf
    • http://www.up4everything.com/uploads/1/3/0/5/130546971/3325000.pdf
    • http://westviewpictures.com/uploads/1/3/0/5/130544226/9563549.pdf
    • http://realestatelearningnetwork.org/uploads/1/3/0/4/130483546/tenamusenewu-tasavumodelakud.pdf
    • http://argylemangoes.com/uploads/1/3/0/6/130604061/b68b958336933.pdf
    • http://hiddengnomefilms.com/uploads/1/3/1/4/131407855/nigelexaj.pdf
    • http://aclimited.org/uploads/1/3/0/5/130547078/3253474.pdf
    • http://butteranchenterprises.com/uploads/1/3/0/6/130620348/2b7b84ed3.pdf
    • http://whatscript.com/uploads/1/3/0/7/130739000/dunuz_remaluludak_ziwaperepojab.pdf
    • http://www.sarahs-maternity-1.emaankhawaja.com/uploads/1/3/0/3/130323573/7050575.pdf
    • http://thejbird.com/uploads/1/3/0/4/130489649/sogulumijumanaxupul.pdf
    • http://siteless.club/uploads/1/3/0/7/130775701/a372b45425c964.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ccc.bin
8ff039f47ebc119126b5dece7769e8eed59a9e7a51ec026488ffa491cabd9972		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CCC 6696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.