Malicious PDF — malware analysis report

Static analysis result for SHA-256 c992f8b0058f6373…

MALICIOUS

PDF

45.9 KB Created: 2020-03-30 16:29:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a9b67779f97f80da71e1ebc8cf6b5aa9 SHA-1: c740f81417d657f5bb85d447cc474552b3807edf SHA-256: c992f8b0058f63736e45ccc1e00ffc1ce1d085d816870990a834244a3856d1de
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to similarly structured URLs on different domains, indicating a link farm or SEO poisoning tactic. The document body, though heavily obfuscated, contains references to 'Propiedades termicas pvc' and the wkhtmltopdf generator, suggesting a lure document. The primary attack pattern involves directing users to these external URLs, which are likely hosting malicious content or phishing pages. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://juliejesternewman.com/uploads/1/3/1/1/131164452/131164452.html#propiedades+termicas+pvc
    • http://rubiconindiana.com/uploads/1/3/0/6/130620700/1028112.pdf
    • http://scifichickmuses.com/uploads/1/3/0/7/130775002/furuxugepet-jorupixexe-musawava-tekakimekalevi.pdf
    • http://thetrainingyogi.com/uploads/1/3/0/8/130874272/sodulebupuz.pdf
    • http://faiza-portfolio.com/uploads/1/3/0/8/130874220/af153c9.pdf
    • http://realgearforrealguys.com/uploads/1/3/0/4/130476229/geporelabalag.pdf
    • http://bracefriendship.com/uploads/1/3/0/3/130323632/jemup-dudirarumawofi-mupugef.pdf
    • http://missgagne.com/uploads/1/3/0/5/130544384/fififuberale.pdf
    • http://flordelinframundo.com/uploads/1/3/0/2/130287279/pitonoragima.pdf
    • http://angiessoulspace.com/uploads/1/3/1/4/131438570/fovavigegejuti.pdf
    • http://pretinterpret.com/uploads/1/3/0/6/130605515/879ddfd7.pdf
    • http://art2artexhibitions.com/uploads/1/3/0/8/130814063/3120294.pdf
    • http://crafterafterhours.com/uploads/1/3/0/6/130639853/8911561.pdf
    • http://christianbebrave.org/uploads/1/3/0/5/130539120/a3ac8ed13234ac7.pdf
    • http://autospadeuce.com/uploads/1/3/0/3/130323573/lebitizalefujogixe.pdf
    • http://wineracingteam.com/uploads/1/3/0/8/130815097/fineguwizawix.pdf
    • http://lsroofingcontractors.com/uploads/1/3/1/3/131378840/2683904.pdf
    • http://storytimewithteta.ca/uploads/1/3/0/3/130323703/5827151.pdf
    • http://giantacorn.com/uploads/1/3/0/4/130475966/1609311.pdf
    • http://barbara-ronny.com/uploads/1/3/0/8/130874493/a50c7971bb.pdf
    • http://abstainpureandsimple.org/uploads/1/3/0/5/130590413/c466b52834f03.pdf
    • http://europeanfunds.net/uploads/1/3/0/2/130289542/515725.pdf
    • http://northeastflowershop.com/uploads/1/3/0/5/130588984/bc8801e21bc5.pdf
    • http://rutaglobal.club/uploads/1/3/0/6/130621068/senufaku.pdf
    • http://tektronicusa.net/uploads/1/3/0/7/130740550/7998b5763104.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075a1.bin
039c740dbb637ab47a890d8d80c13266508df66c1e4e721a7cf08f7694536847		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75A1 8256 bytes
font_01_sfnt_off0000934b.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x934B 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.