Malicious PDF — malware analysis report

Static analysis result for SHA-256 edb0ae15e2a7f07d…

MALICIOUS

PDF

26.3 KB Created: 2020-03-22 03:26:33 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 98b1a36f2df8689f7b6cb5afeea26561 SHA-1: fb0c55b7b8de722c871d9e1eef69216fdc941320 SHA-256: edb0ae15e2a7f07debd00efb1e9e67cf7d43fab544485a9499a7398ce2e684ea
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document is identified as malicious by an ML classifier and exhibits characteristics of a phishing lure, including a single image and minimal text content. It contains numerous external links, with the primary one being http://dariobova.com/uploads/1/3/0/7/130775654/130775654.html#sack+n+save+nanakuli+western+union. The document body, though heavily obfuscated, also contains this URL and other PDF links, suggesting a link farm designed to redirect users to potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 26 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dariobova.com/uploads/1/3/0/7/130775654/130775654.html#sack+n+save+nanakuli+western+union
    • http://aaagradeclothing.com/uploads/1/3/0/6/130604257/7805952.pdf
    • http://zhajinhua.f18.ebkf.org/uploads/1/3/0/6/130604993/nurabaxitelala-lopive.pdf
    • http://barrysherbals.com/uploads/1/3/0/2/130271013/fofapudiza.pdf
    • http://www.uclaarea.org/uploads/1/3/0/7/130774981/e3a21.pdf
    • http://portermillstudios.com/uploads/1/3/0/7/130739830/lajemadivuxokap.pdf
    • http://jamesonbooks.com/uploads/1/3/0/2/130273980/3397246.pdf
    • http://sbminerdesign.com/uploads/1/3/0/7/130739789/9634956.pdf
    • http://growingfullyhuman.com/uploads/1/3/0/6/130621630/rifopuxi-tomalirotupamu.pdf
    • http://danarideoutpace.com/uploads/1/3/0/7/130740524/1048310.pdf
    • http://hostmaster.tobiasinnola.com/uploads/1/3/0/9/130968976/xazobokolaremozore.pdf
    • http://myectopicdays.co.uk/uploads/1/3/0/7/130740086/211157.pdf
    • http://paolosiccardo.com/uploads/1/3/0/2/130271087/bukezatataxo.pdf
    • http://tanjon6.club/uploads/1/3/0/4/130476976/biwigonunemuv.pdf
    • http://fillmorebulldogbands.com/uploads/1/3/0/7/130738487/c92171ca8b1.pdf
    • http://cbearfreightbrokersllc.net/uploads/1/3/0/7/130738836/batovukovunu.pdf
    • http://bouquetexclusief.com/uploads/1/3/0/4/130436410/8551933.pdf
    • http://chattanoogaskateparkproject.org/uploads/1/3/0/7/130775109/dazalijewivozef.pdf
    • http://keep-rising.org/uploads/1/3/0/7/130738569/boger.pdf
    • http://adammatheny.com/uploads/1/3/0/5/130545360/fiketiwubud-wijavunolat-samoximitalav.pdf
    • http://sprivot.com/uploads/1/3/0/5/130589199/lulatevaxuz-lodowozod-pusewokaroram-fotumowugu.pdf
    • http://huangguanzuqiuchang.f18.ebkf.org/uploads/1/3/0/8/130874511/gekuzaxula_jefogi.pdf
    • http://www.ankhomeinnovatorsinc.com/uploads/1/3/0/6/130621456/soturavejubelavamuw.pdf
    • http://asmallundertaking.com/uploads/1/3/0/3/130313046/pumuk-dejugivez.pdf
    • http://rss-me.com/uploads/1/3/0/2/130272909/60c38f0ceb.pdf
    • http://bluesagedirection.com/uploads/1/3/0/9/130969755/nazorolulone.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.