Malicious PDF — malware analysis report

Static analysis result for SHA-256 c62fa3efb8dabdff…

MALICIOUS

PDF

57.1 KB Created: 2020-03-26 02:17:32 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9ec9cf2430f389bc2faaee8baf35b01c SHA-1: 040c8788def9deb4e206b761048f9c33c1588c85 SHA-256: c62fa3efb8dabdffb6a26aba952ec6eacde77895c9bba0bbd5ef1d408c800a13
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body text, though garbled, contains a URL that is also present in the list of external links. This suggests a link farm or SEO poisoning attack designed to drive traffic to numerous PDF files hosted on unrelated domains. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://paulcurryelectrics.com/uploads/1/3/0/6/130620525/130620525.html#all+but+which+of+the+following+are+considered+strengths+of+self-report+personality+inventories
    • http://soundcloudguru.com/uploads/1/3/0/5/130551859/nukabu_sesawatenipumad_rolipupegekal.pdf
    • http://www.karenskindredspirit.com/uploads/1/3/0/5/130544734/7016ad1ce9d1f28.pdf
    • http://saraberrinoimmobiliare.com/uploads/1/3/0/8/130814157/1249126.pdf
    • http://www.mitztutoring.com/uploads/1/3/0/8/130874018/rujesiwurafuto.pdf
    • http://johnnysaddles.com/uploads/1/3/0/4/130489123/8365296.pdf
    • http://shaku.us/uploads/1/3/0/2/130289395/ebb4f.pdf
    • http://mypillowdesigns.com/uploads/1/3/0/6/130639061/e84fd093e923f.pdf
    • http://www.musiciansnutrition.com/uploads/1/3/0/4/130483566/6249000.pdf
    • http://theoverflowingcloset.com/uploads/1/3/0/8/130874501/xapefiso-fibabukurepop.pdf
    • http://mathtutoringumichigan.com/uploads/1/3/0/6/130604192/pepezuvinad.pdf
    • http://www.catherinelapointe.com/uploads/1/3/0/5/130539933/3535517.pdf
    • http://www.kahakulani.com/uploads/1/3/0/9/130969041/03bd0ec69bdd3a.pdf
    • http://thethinkplace.info/uploads/1/3/0/2/130272880/38d9afd50f62aa5.pdf
    • http://jbaudiodesign.org/uploads/1/3/0/6/130639083/4677846.pdf
    • http://twistedlolli.com/uploads/1/3/0/5/130543771/zegilejagavasapedo.pdf
    • http://dogged-cog.com/uploads/1/3/0/6/130639824/719cb2a5c733.pdf
    • http://www.markeshawattree.studio/uploads/1/3/0/6/130604497/9273072.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b448.bin
945d96c935acf11b04b52d02de079da198e948ba68d6006725997739bc2e59a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB448 8712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.