Malicious PDF — malware analysis report

Static analysis result for SHA-256 db537cd3f8c6d22d…

MALICIOUS

PDF

39.7 KB Created: 2020-03-29 02:19:02 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a189111cd8ca91017d0d4bae35cb5022 SHA-1: 7c2d560839aa2df3f47f59725746081ef8cd44e1 SHA-256: db537cd3f8c6d22df545e02d27ff7a58d2e05273f104d38e04b571f56f12c303
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files hosted on various domains, a technique often used for SEO spam or to distribute malicious content. The ML classifier strongly indicated maliciousness. The document body, though partially corrupted, contains a URL that mirrors one of the extracted links, suggesting a deliberate attempt to redirect the user.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-76-213.mgwnet.com/uploads/1/3/0/6/130621859/130621859.html#que+es+microestructura+en+espa%C3%B1ol
    • http://carolinapumpworks.com/uploads/1/3/0/6/130605341/paviziremovo.pdf
    • http://wiccadsisters.com/uploads/1/3/0/7/130740163/29b274fd7a5e244.pdf
    • http://stanyarhouse.com/uploads/1/3/0/5/130540788/vebojob.pdf
    • http://100wwclickingcounty.org/uploads/1/3/0/8/130874328/boxumekoboti-sitax-xuligozawoguxip-famobok.pdf
    • http://tidytaxtools.com/uploads/1/3/0/7/130775540/livotide.pdf
    • http://lauralemay.net/uploads/1/3/0/5/130544078/filusanuw_gefiju.pdf
    • http://peopleinsyncltd.com/uploads/1/3/0/7/130739147/75b523a2.pdf
    • http://gabthinker.com/uploads/1/3/1/4/131407214/golimipuboxozil.pdf
    • http://triadageless.com/uploads/1/3/0/4/130490602/8880129.pdf
    • http://balticgraphics.com/uploads/1/3/0/5/130541073/2101191.pdf
    • http://www.ujwalinvestment.com/uploads/1/3/0/6/130603946/sonubalonaw_gajonowat_xamowi.pdf
    • http://cameronbaskin.com/uploads/1/3/1/3/131382113/liwebaraj-sokuzotobezer.pdf
    • http://www.gisfornugget.com/uploads/1/3/0/8/130873863/fekagasotegaw.pdf
    • http://ineavet.com/uploads/1/3/0/5/130551692/129e9b6a1001.pdf
    • http://mostdeliciouspoison.com/uploads/1/3/0/6/130621000/7589674.pdf
    • http://bartowwinds.org/uploads/1/3/0/6/130621191/musomojodiv_donutafederum.pdf
    • http://beseen-site.com/uploads/1/3/0/4/130488312/bed3f338e8.pdf
    • http://happyterapias.com/uploads/1/3/0/7/130775186/a38c2d43cae.pdf
    • http://kcustomllc.com/uploads/1/3/0/5/130590637/mibalajebiwin.pdf
    • http://insideout.pro/uploads/1/3/1/0/131070055/niwujivu-tikem-kemova-vitedodalikufek.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000701e.bin
9ddf7811745bbb7047121fa0752dbea4f2a2875a7c5ee9d5eb5bacea2ab9dd25		 pdf-font-stream PDF embedded font (sfnt) at offset 0x701E 8552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.