Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb83b3bdd328f326…

MALICIOUS

PDF

27.2 KB Authoring application: PDFedit
MD5: e67fe7648501f1a69707ddc69a57ed05 SHA-1: 1818ed3c06b12ad42ad27064088288010e5f9c77 SHA-256: cb83b3bdd328f326dd8b4d72fb72fbfe5c20772a2d552d2cf10be665169e29e3
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves directing users to a vast array of external PDF files hosted across numerous domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://morganneason.com/uploads/1/3/0/6/130620840/towudavikegoni_rizegisa.pdf
    • http://bibleworld.us/uploads/1/3/0/5/130588653/6866c160d6b1c5.pdf
    • http://mta-sts.rexcosteel.com/uploads/1/3/0/7/130775076/ab5accb56f3d4.pdf
    • http://newamsterdamize.net/uploads/1/3/0/6/130639312/labemixodobuladowux.pdf
    • http://texassupercool.com/uploads/1/3/0/7/130739564/8ea9612c.pdf
    • http://studio-jrochielle.com/uploads/1/3/0/6/130605299/6632349.pdf
    • http://rocones.com/uploads/1/3/0/7/130776253/1483488.pdf
    • http://defenselogisticsalternatives.com/uploads/1/3/0/5/130539227/93d4d25.pdf
    • http://beach.rileyelizabethphotography.com/uploads/1/3/0/7/130775892/wofawaresexemek.pdf
    • http://ukrehabadvice.com/uploads/1/3/0/8/130873736/faae2a548b.pdf
    • http://musiowskyed.com/uploads/1/3/0/2/130273576/34f336feb6257.pdf
    • http://hostmaster.dziaugsmodiena.lt/uploads/1/3/0/6/130621167/5555807.pdf
    • http://hostmaster.ecklandsteel.co.uk/uploads/1/3/0/6/130621901/pitazu.pdf
    • http://ceresevents.org/uploads/1/3/0/5/130539763/dexumativazasot_lalumu.pdf
    • http://www.oasimontidibidda.com/uploads/1/3/0/6/130604590/furarovorogifaw.pdf
    • http://cheongsoongan.com/uploads/1/3/0/8/130874114/6e4f3950a8b.pdf
    • http://mx.mcarredi.com/uploads/1/3/0/2/130288533/rodobura.pdf
    • http://menedzer.website/uploads/1/3/0/4/130476678/vijiku-notarufaki-novanodid-jajom.pdf
    • http://ghstyle.es/uploads/1/3/0/8/130813787/768bd.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000042db.bin
89093cc2fb390c7f03822e4ee8674234ef0f58ce025ab9d30e89c0c80d407f4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x42DB 7876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.