Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8a4822d4c332199…

MALICIOUS

PDF

39.0 KB Created: 2020-03-07 21:19:20 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b9a650a0c91b9300971a419c61b9a367 SHA-1: 1ee7c92a56ca24db6c859cfecee19bb246dde451 SHA-256: c8a4822d4c33219913be93c0f700537915a9d6b25ff96acced3663fbb5e17429
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links to other PDF files hosted on various domains. This pattern is indicative of SEO poisoning or a link farm used to distribute malicious content or redirect users to phishing sites. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://inyago.org/uploads/1/3/0/9/130969016/130969016.html#acropora+hyacinthus+pdf
    • http://bikefishski.com/uploads/1/3/0/5/130588564/bokarowas.pdf
    • http://www.neliscreations.com/uploads/1/3/0/8/130813762/fukisanow.pdf
    • http://miriamterron-elder.com/uploads/1/3/0/4/130483277/rajifotax-tonakal-pimiwodamal-guzebil.pdf
    • http://doorado.net/uploads/1/3/0/5/130540159/doxutivitizi-tugidezivuru-dagegiw-liwub.pdf
    • http://revelsites.com/uploads/1/3/0/2/130272575/ac1ebf8294c79.pdf
    • http://290pleasantstu313.com/uploads/1/3/0/5/130588240/rarake_zubujimokakuv_xodemov.pdf
    • http://rnbproperties.net/uploads/1/3/0/4/130476944/1eebcdfb5b077.pdf
    • http://www.itsthelittlethingsftmyers.com/uploads/1/3/0/7/130775260/6870945.pdf
    • http://bballguru.com/uploads/1/3/0/2/130273993/metokagonelusu.pdf
    • http://monteur-zimmer-gelsenkirchen.de/uploads/1/3/0/4/130488331/314457.pdf
    • http://movementuniversity.com/uploads/1/3/0/7/130739754/94c61f7a29.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006fe6.bin
a252978f234c46a949000ec470c1b5d6c5cb677918abdd6b199498033cd94378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FE6 8156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.