Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca65d1bf420b70b9…

MALICIOUS

PDF

34.0 KB Created: 2020-04-16 06:14:01 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 005cf5ee9afab598735bd9e9fb3950b6 SHA-1: c851391e88c912706beb739071de584c4b95c91f SHA-256: ca65d1bf420b70b9a1df43130a5a433907c7d5d32a785eef99c822a710db4339
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous external links, a technique commonly used for SEO spam or to redirect users to malicious sites. The document body, though heavily obfuscated, contains text related to a 'pronunciation guide' and the wkhtmltopdf tool, suggesting a lure. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hello-baby-toys.com/uploads/1/3/0/3/130313649/130313649.html#photosynthesis+pronunciation+guide
    • http://littlerookie.de/uploads/1/3/0/3/130313152/zomevow-dajabinefuna.pdf
    • http://cess-less.com/uploads/1/3/1/6/131606368/1612785.pdf
    • http://hearthorse.org/uploads/1/3/0/7/130739528/e57e1e06.pdf
    • http://followyourspark.org/uploads/1/3/0/5/130550770/8387267.pdf
    • http://studentsbet.com/uploads/1/3/0/2/130287441/jevigiv-fibisun-roxijavimiwola-maligepanet.pdf
    • http://ryanjmcvay.com/uploads/1/3/0/4/130489152/gajep.pdf
    • http://eqwineretreat.com/uploads/1/3/0/7/130740465/pumajedipuxu.pdf
    • http://threeelephantsand.co/uploads/1/3/1/4/131408371/e1501d6d9d.pdf
    • http://heatingandcoolingwestbloomfield.com/uploads/1/3/1/4/131437322/b19505e80ca.pdf
    • http://corealis-ing.net/uploads/1/3/0/7/130776295/6336286.pdf
    • http://cinespiration.com/uploads/1/3/0/8/130814630/wumomosawadoni_dizuvobelol_gifugofuzataga.pdf
    • http://waterweeknorth.ca/uploads/1/3/0/7/130776047/luvafufofuweziw-tevonadone-gisofutalo.pdf
    • http://yourworth.business/uploads/1/3/0/7/130739348/0102cec97b3f2e4.pdf
    • http://papergroupusa.com/uploads/1/3/0/4/130475992/soxanotaluma_bukovuxut_bumorurumat_pifiporo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f36.bin
285e915b11ebd9cda4c58074614f0e318037822bc8ac248f40208674a20c96f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F36 7204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.