Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0d41d7228877be1…

MALICIOUS

PDF

46.5 KB Created: 2020-03-30 07:52:10 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c0c539e1c67d1beb531af28c065b1cfa SHA-1: 669bac823e1e7e05496eebda606a604de906aefd SHA-256: e0d41d7228877be12ebb8e6919650d6c0efcd75d454bfa4fdfaffe67d8ae7d78
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are dynamically generated with numeric slugs, indicative of a link farm or SEO poisoning tactic. The document body, though partially corrupted, contains text related to childbirth and mentions the PDF generation tool 'wkhtmltopdf', suggesting a lure to trick users into visiting these external sites. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.equestrianeliteatapplejackfarm.com/uploads/1/3/0/6/130620934/130620934.html#trabajo+y+mecanismo+de+parto+pdf
    • http://coolmanraulh.com/uploads/1/3/1/3/131384153/merululokokizizuboku.pdf
    • http://goodmanmyanmar.com/uploads/1/3/0/7/130740117/zanituvon_xuxofaj_kivipixubanol.pdf
    • http://itslavishbitch.com/uploads/1/3/0/5/130551949/fakadofivumepejef.pdf
    • http://bowlitas.com/uploads/1/3/0/8/130873838/lalilogobomuvamoj.pdf
    • http://4055nelsonavenue.com/uploads/1/3/1/1/131163752/surigugudigab.pdf
    • http://inter-corporation.pl/uploads/1/3/0/5/130540049/3aaad.pdf
    • http://susancarterfricks.com/uploads/1/3/0/5/130539300/xaxexebulivi-nudovevar-lukitowisemuwa-jikap.pdf
    • http://wileybrands.com/uploads/1/3/0/4/130483302/dolaganivudarosulit.pdf
    • http://lldgc.com/uploads/1/3/0/5/130550880/9833941.pdf
    • http://philambdadelta.com/uploads/1/3/0/2/130272932/wofiwofoxarelure.pdf
    • http://swingingtheblues.net/uploads/1/3/0/5/130588239/xiledo.pdf
    • http://yougotsmile.com/uploads/1/3/0/3/130324451/3bbe0.pdf
    • http://whatsyourtissueissue.com/uploads/1/3/0/5/130588895/nazilevotagupim.pdf
    • http://windbeesearth.com/uploads/1/3/0/4/130476557/gipibugomobazi.pdf
    • http://seamistcollies.com/uploads/1/3/0/3/130323552/6102fd12d2bd4ed.pdf
    • http://reisebasar.ch/uploads/1/3/0/5/130543466/bujotib_dixudizopo_xokawe.pdf
    • http://hogholsters.com/uploads/1/3/0/4/130476372/1208041.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008e72.bin
fc3630cca13c7f888693db907390e938bd538ed47e0730ae984d6dcd4ec681c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8E72 7852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.