Malicious PDF — malware analysis report

Static analysis result for SHA-256 dcde13ce1e1bdc6c…

MALICIOUS

PDF

39.8 KB Created: 2020-04-08 16:11:32 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9f34312105fff6d4e1060f4a73da4bfa SHA-1: a2c2377354349a5453b0c6b2c495270d6d21cfbd SHA-256: dcde13ce1e1bdc6ce800dbeaa9bc4cd9cf600471146a6d66257b6cff6ca1d113
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links to other PDF files hosted on various domains, indicating a link farm or distribution network. The ML classifier strongly flagged this PDF as malicious. The document body contains metadata related to PDF generation, but no direct user-facing text that would suggest a specific lure. The primary attack pattern observed is the mass distribution of links to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://christinabeautyparlour.com/uploads/1/3/0/6/130620923/130620923.html#paris+to+the+moon+book
    • http://freedommedicalassociation.com/uploads/1/3/0/5/130545434/556d5a5a79f1.pdf
    • http://action-appliance-installation.net/uploads/1/3/0/2/130270923/c0bd0c49d5.pdf
    • http://amandacavs.com/uploads/1/3/0/7/130740624/bef21b77123487.pdf
    • http://teachmegeography.com/uploads/1/3/0/4/130491699/7141be75b1e2f.pdf
    • http://enjoyhomestay.com/uploads/1/3/0/7/130775200/dfa9fd3d75a.pdf
    • http://treeoflifepress.com/uploads/1/3/0/5/130539019/nuwewezife.pdf
    • http://electricbicycleconsulting.com/uploads/1/3/0/5/130590162/7858810.pdf
    • http://loseweightwithsurgery.com/uploads/1/3/0/7/130776739/movurex.pdf
    • http://bennettandsonconstruction.com/uploads/1/3/0/5/130542940/722fe5046b34ea.pdf
    • http://shilpistepforhappiness.com/uploads/1/3/0/8/130874287/1272812.pdf
    • http://elmoshade.com/uploads/1/3/1/3/131379726/ganujo_xolamelukavu_sivigepexawim_jidaxilurari.pdf
    • http://gayflava.com/uploads/1/3/0/3/130313320/fasujasakawa.pdf
    • http://lkradio.online/uploads/1/3/0/2/130274145/f649f86ad155a4b.pdf
    • http://peoplesmedicine.us/uploads/1/3/0/6/130604882/bae401201c5c067.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000073e1.bin
bdb261a65fb47f20431b55f87a74a8e4897e5921f539f4ab6535d29e1f2fe97c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73E1 7980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.