Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4cc087f07fb3e26…

MALICIOUS

PDF

39.5 KB Created: 2020-04-03 04:10:18 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b0c945d5554d6a2feda477c3b8b590cc SHA-1: 014d4d6fe1e9ba1e2b1120f330af4f7d624f9cee SHA-256: e4cc087f07fb3e26900b41a4b643254a0e0aa312f877ba08f6e14ad283283180
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to various domains, a technique commonly used for SEO manipulation or to host malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves directing users to a vast network of linked PDFs, likely to distribute malware or conduct phishing, rather than delivering a payload directly from this document.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpoa.org/uploads/1/3/0/2/130272573/130272573.html#call+of+cthulhu+ps4+review+youtube
    • http://beccareher.com/uploads/1/3/0/2/130288551/tisezaremomowen-gidinu.pdf
    • http://ascakes.catering/uploads/1/3/0/2/130289746/8466170.pdf
    • http://leisurist.com/uploads/1/3/0/2/130270893/e580a5253.pdf
    • http://girlfriendsfitnessparsons.com/uploads/1/3/0/5/130590535/xusojimuju.pdf
    • http://smivisions.com/uploads/1/3/0/7/130739459/9282686.pdf
    • http://thecandistore.com/uploads/1/3/1/1/131163695/36476f2285004f2.pdf
    • http://larimarmarket.org/uploads/1/3/0/5/130588157/8543822.pdf
    • http://callumsstag.com/uploads/1/3/0/5/130543743/0dceb7ff.pdf
    • http://decrisis.org/uploads/1/3/0/6/130639852/687880.pdf
    • http://jamiemastersschoolofdance.com/uploads/1/3/0/6/130621165/kusagipub.pdf
    • http://www.lesbonssavons.com/uploads/1/3/0/6/130604108/51dfc1129.pdf
    • http://jillianshanahan.com/uploads/1/3/0/8/130874386/banewatagufipi_fepitabo_dazususov.pdf
    • http://nomadicwellness.com/uploads/1/3/0/4/130435561/runanujomujiwobik.pdf
    • http://fisherdecor.com/uploads/1/3/0/4/130483937/dixara_tagepu.pdf
    • http://sochelifestyle.com/uploads/1/3/0/4/130483390/gabogejugixosiw.pdf
    • http://glam5jewbiz.com/uploads/1/3/0/4/130490776/taxewaxatokokonok.pdf
    • http://healthstyl.org/uploads/1/3/0/4/130476396/0cb7e32.pdf
    • http://arsenicofjabir.com/uploads/1/3/0/8/130813643/6778879.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000074b9.bin
2e940d39a37191c490aab8196fb97e63b5a3d930673f25b3f4542f30705ecbd4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74B9 7052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.