Malicious PDF — malware analysis report

Static analysis result for SHA-256 c854b6094530a45d…

MALICIOUS

PDF

35.2 KB Created: 2020-05-13 16:53:50 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: acaa16e78fb8f5946644f5a5206a46e9 SHA-1: 7e249108643e4903b8638b940509528093db361e SHA-256: c854b6094530a45db91891e22db28a7300e5f3af3e90e4c1b4921b862427ac40
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text, though partially corrupted, includes a URL that points to a potentially malicious resource. The ML classifier also flagged this PDF as malicious with high confidence. The primary attack pattern appears to be directing users to a network of external sites, likely for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://restage.tv/uploads/1/3/0/6/130639157/130639157.html#a+return+to+salem%27+s+lot+1987
    • http://aaamidsouthtreeservice.com/uploads/1/3/1/6/131637143/bixurusutimebaw.pdf
    • http://jwcampbellconstructioninc.com/uploads/1/3/0/5/130551483/f6377b.pdf
    • http://manormatrix.com/uploads/1/3/0/4/130483572/dejasusog.pdf
    • http://jwballiance.com/uploads/1/3/1/3/131384135/bazatus-pupojokup-gumopazaj-wakizuto.pdf
    • http://oakdalepoolservice.com/uploads/1/3/0/7/130776661/9c16ba1d1d58974.pdf
    • http://randyonbass.com/uploads/1/3/0/9/130969674/ee917dcc.pdf
    • http://independentdentalcenters.com/uploads/1/3/0/2/130288410/fiworebimaduzopip.pdf
    • http://arizonaapartmentbrokers.com/uploads/1/3/1/3/131380786/31f07.pdf
    • http://historicukiahtahoehighway.com/uploads/1/3/1/3/131398095/zazipilurufij.pdf
    • http://simplyperfectnutrition.com/uploads/1/3/0/7/130775265/pixitixetadafo.pdf
    • http://gr8tk.com/uploads/1/3/0/2/130291355/5981803.pdf
    • http://katesbeautyroom.net/uploads/1/3/0/4/130476501/464914.pdf
    • http://alalogistics.org/uploads/1/3/1/4/131483371/fogigabevor.pdf
    • http://fredericknational.org/uploads/1/3/1/3/131381332/zukiforejek_jawoseg_vukunerub.pdf
    • http://allproroofingsolutionsllc.com/uploads/1/3/0/5/130590503/6624233.pdf
    • http://beyazturk.org/uploads/1/3/1/3/131383207/xizaloxija.pdf
    • http://ganeshastroscience.com/uploads/1/3/1/4/131453871/kebutoza.pdf
    • http://jeffcentrelloactor.com/uploads/1/3/1/3/131398246/zanoduvajagibep-zilotaxa.pdf
    • http://camposdeprovence.com/uploads/1/3/0/5/130543133/2d4fc01d806a1.pdf
    • http://kynutnbetter.com/uploads/1/3/1/0/131071095/c6446f.pdf
    • http://hostmaster.flocrowcroft.co.uk/uploads/1/3/0/6/130639138/jidiredo.pdf
    • http://ashleystopczynski.com/uploads/1/3/0/9/130968997/fonojunasesa.pdf
    • http://nomnomgelato.com/uploads/1/3/0/6/130639635/6693432.pdf
    • http://cordelepropertiesllc.com/uploads/1/3/0/2/130287513/desimamurexajure.pdf
    • http://chapmanfarrellgroup.com/uploads/1/3/1/4/131437821/bumelovawibamepop.pdf
    • http://chapmanfarrellgro
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005b54.bin
fe8d89fa7c7e112c94004473d427bdf52ffa8f4c7d4aa95b56416517ec2a0b1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B54 10544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.