Malicious PDF — malware analysis report

Static analysis result for SHA-256 da5783286320195c…

MALICIOUS

PDF

40.0 KB Created: 2020-03-30 13:31:40 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b54dc3796b998b3fe3a79e2d5090e239 SHA-1: 8b603f0644e8b01c2e9b42fb0d559a352b9135dc SHA-256: da5783286320195cf57ea2d8708f6654a7d182a6419aebfe1800016165031f54
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. The 'PDF_SEO_LINK_FARM' heuristic specifically identifies this behavior, pointing to numerous PDF files hosted on various domains. While no scripts were extracted, the sheer volume of outbound links suggests a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://multistreams.com/uploads/1/3/0/6/130622027/130622027.html#5+ejemplos+de+oraciones+con+sustantivos+propios
    • http://uminnesotamap.com/uploads/1/3/0/2/130289335/1db54b48088.pdf
    • http://pibackoffice.com/uploads/1/3/0/5/130588415/6003542.pdf
    • http://newenglandopportunityproject.org/uploads/1/3/0/6/130604561/3446994.pdf
    • http://mysundaycakes.com/uploads/1/3/1/3/131398404/2198caf98.pdf
    • http://tusotolifestyle.com/uploads/1/3/0/7/130775558/gizonepagiza.pdf
    • http://laent.org/uploads/1/3/1/3/131384414/kijeso.pdf
    • http://eduaneheady.com/uploads/1/3/0/4/130436095/nujonazo.pdf
    • http://martialarts-center.com/uploads/1/3/0/5/130552073/e0324f3ccb35.pdf
    • http://tomisenamakeup.com/uploads/1/3/1/0/131070006/savojemusid.pdf
    • http://shabechildcarecenter.com/uploads/1/3/0/5/130588745/budamadowez_nodifadireg_wugedubu.pdf
    • http://jerrodkowalski.com/uploads/1/3/0/6/130640006/2f4e98.pdf
    • http://youngmomsguidetolife.com/uploads/1/3/0/8/130874683/4d9b5248ffd2a9.pdf
    • http://ntro4k.com/uploads/1/3/0/4/130489123/fipolowag.pdf
    • http://slaccountingsolutions.com/uploads/1/3/0/8/130814475/guxenigagi-lumadajis-fogabe-xodimokok.pdf
    • http://langresbookshop.com/uploads/1/3/0/8/130874439/9961042.pdf
    • http://freezetolerantballvalve.com/uploads/1/3/1/3/131383242/77b555becfcf9b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000716b.bin
ccac8c1f2a6fee3187e3eb8ce25ac28b28755dcb3adbd57e579e225531774e23		 pdf-font-stream PDF embedded font (sfnt) at offset 0x716B 8628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.