Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9eae7a0b8f2723f…

MALICIOUS

PDF

48.7 KB Created: 2020-05-05 06:27:03 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a79d07806490857370a254ed6ae20f74 SHA-1: 521b046bef97bd7dc50612ce533d544d1eb71f99 SHA-256: d9eae7a0b8f2723f8f96cdc39b28edfe634313ede2582de3053ee864961f41b4
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to other PDF files hosted on similar domains. The document body text explicitly mentions 'Aptoide tv apk for windows 10', suggesting a lure to download software. The PDF_SEO_LINK_FARM heuristic indicates a mass of external links designed to manipulate search engine results, a common tactic for distributing malware or unwanted software. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://globaly.services/uploads/1/3/1/3/131379373/131379373.html#aptoide+tv+apk+for+windows+10
    • http://slipperyagency.com/uploads/1/3/0/2/130272348/3531001.pdf
    • http://vividcoating.com/uploads/1/3/0/8/130874639/60d048fc78bc6.pdf
    • http://aahfi.com/uploads/1/3/1/4/131407135/gugebelo-faxigepimamowu-bojenewavuma-zuvixalexefaw.pdf
    • http://aearthsport.com/uploads/1/3/0/6/130639892/ffd9140dc.pdf
    • http://thebakehouse.space/uploads/1/3/0/7/130740376/vobogobowituwi_lonepala_tidopoduba.pdf
    • http://freestyle-online.biz/uploads/1/3/1/4/131437982/lageke.pdf
    • http://denihawkins.com/uploads/1/3/1/6/131606256/fabexef_bimibuved_wokusezufofo.pdf
    • http://southkingsmodern.com/uploads/1/3/0/3/130313309/gasatedodopejo_zixakiz_vaxir_vorix.pdf
    • http://palmetto.shop/uploads/1/3/1/4/131454731/bexafidelipuj.pdf
    • http://cprep7.com/uploads/1/3/0/7/130776230/9888759.pdf
    • http://brightlightspreschool.com/uploads/1/3/0/4/130488734/8595941.pdf
    • http://jggperfumechick.com/uploads/1/3/1/4/131407110/zetigofa-rusegi-ziwubixatuzuno.pdf
    • http://freedomwaycapital.com/uploads/1/3/0/2/130272973/baponu.pdf
    • http://bravelittleworldminis.com/uploads/1/3/0/7/130775866/8066140.pdf
    • http://limitlessvoyage.com/uploads/1/3/0/3/130323266/migugugax-viretupug-tavuf-kemor.pdf
    • http://fulfillingjourney.com/uploads/1/3/1/8/131856054/8217186.pdf
    • http://taempresas.com/uploads/1/3/0/2/130289508/6ca8d52966.pdf
    • http://dancept.org/uploads/1/3/0/5/130589056/lugumefasaporuw.pdf
    • http://180702883852813651.com/uploads/1/3/1/3/131383820/0a23eb9835b2ea7.pdf
    • http://55688carce.com/uploads/1/3/0/6/130604292/bajiwisik-lokedozej.pdf
    • http://doormatordiva.ca/uploads/1/3/0/6/130639467/e7afd.pdf
    • http://ncaafootballdynasty.com/uploads/1/3/1/3/131380482/gowukateneg-xugox-palawevezivisem.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000915f.bin
595dc52b41e46f05b144406e0820ab2ce9ee160c016a5d6ad82e4a30a378d861		 pdf-font-stream PDF embedded font (sfnt) at offset 0x915F 11952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.