Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8e1fec333052a07…

MALICIOUS

PDF

33.9 KB Created: 2020-04-25 05:12:14 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 368437d13e3060adc711077aff9c0efe SHA-1: c5459e276e9105202d23a35d751167da76aa9c9a SHA-256: c8e1fec333052a071b8d234c5280e07c04bd2bdbb8e05827c68c38d543d2127c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a common tactic for SEO spam or phishing campaigns. The document body, though heavily obfuscated, suggests a lure related to an 'ithenticate similarity report'. The ML classifier strongly indicates maliciousness, and the presence of numerous embedded URLs points towards a delivery mechanism for malicious content or further phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://staveleysportsassociation.com/uploads/1/3/0/5/130544385/130544385.html#ithenticate+similarity+report
    • http://bbartbyangelica.com/uploads/1/3/1/1/131164555/cb3edb.pdf
    • http://lovingmemorialchurch.com/uploads/1/3/1/6/131637257/7740aaf.pdf
    • http://teamsaleslink.ch/uploads/1/3/0/6/130621707/govasalenotiju.pdf
    • http://kenziepattillo.com/uploads/1/3/1/4/131406797/bunop.pdf
    • http://kellermarkethouse.com/uploads/1/3/0/7/130738951/xupuguf-favovapu-saboxopujineli.pdf
    • http://leapandlive.com/uploads/1/3/0/7/130775145/1713187.pdf
    • http://melsplace.org/uploads/1/3/0/8/130814382/7216248.pdf
    • http://serviciodeanestesia.com/uploads/1/3/1/4/131407164/3414983.pdf
    • http://ambassadorspirit.org/uploads/1/3/1/3/131379033/bazetog_zevoripapenokuv.pdf
    • http://tribaltigers.com/uploads/1/3/0/6/130604758/katumuvazawu-rutekajoxul.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006904.bin
4adf3ec4b0ce754b81ba2dbd7576971c3973a16f2d03bd4cec51fc2001148080		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6904 8200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.