Malicious PDF — malware analysis report

Static analysis result for SHA-256 d699c7c3c6b68f58…

MALICIOUS

PDF

26.0 KB Created: 2020-04-05 08:03:48 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f53dba3028e7491bca44f82ac2687ca3 SHA-1: b2dedf1fbb2d6aebf305e6d43f3fa902c0c10afc SHA-256: d699c7c3c6b68f58f2b48596eb9c2bd1bef1a0226849850954ff66983c42348a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a distribution mechanism for further malicious content. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://realdeepth.com/uploads/1/3/0/4/130483147/130483147.html#dios+me+ama+acordes+danilo+montero
    • http://akioraconsulting.com/uploads/1/3/0/6/130604238/gevekerozavije.pdf
    • http://dmaeguidance.com/uploads/1/3/0/6/130605190/rekimozafotuxu_kusizugofatawi.pdf
    • http://tendoushi.net/uploads/1/3/1/3/131398379/c6091d6c35b.pdf
    • http://gutymzart.com/uploads/1/3/0/2/130272395/8111be18.pdf
    • http://sara-purcell-technical-coach.com/uploads/1/3/0/8/130874118/labexovow_zukevuzuvap_feropasexan.pdf
    • http://cuttothechasediamonds.com/uploads/1/3/1/4/131406478/6582330.pdf
    • http://stoninoassociation.org/uploads/1/3/0/2/130287920/xuzixiloz-jusoriduvelipo-mefalama-teduzamigatuzi.pdf
    • http://pnrsales.com/uploads/1/3/0/5/130539449/7e66651a3c651.pdf
    • http://anytime.insure/uploads/1/3/0/3/130313044/porun-jilifuvoj.pdf
    • http://nikonmalta.com/uploads/1/3/0/4/130488542/35425.pdf
    • http://bhbsonline.com/uploads/1/3/0/5/130588512/9f01c025e8ecd.pdf
    • http://seventhdaychapel.org/uploads/1/3/0/7/130740556/4209726.pdf
    • http://u-pharmacist.es/uploads/1/3/0/8/130874088/kuxeriz.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.