Malicious PDF — malware analysis report

Static analysis result for SHA-256 ede362207d2280d8…

MALICIOUS

PDF

24.9 KB Created: 2020-04-02 06:24:46 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 19b4e107ce8d66d27975d24a1bd8fed1 SHA-1: 1d9152bd6fc1d3b4ceb3bba0ccaca1b4f3a48045 SHA-256: ede362207d2280d86bc3dfcbd47a6f18d0864514fbd2bc95e09d40eec0252c72
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ML classifier also strongly indicated maliciousness. The document body, though partially corrupted, contains a URL that is also present in the list of external links. This suggests the document's primary purpose is to redirect users to a network of potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://argylebunnyclothing.ca/uploads/1/3/0/4/130488983/130488983.html#cancion+cristiana+aunque+un+ejercito+acampe+contra+mi
    • http://p3fg.com/uploads/1/3/0/6/130604022/vuvuvuraduwokoz-motidalemel.pdf
    • http://eloyjrojas.com/uploads/1/3/0/4/130476083/tinagerupoge.pdf
    • http://bachfloweressentials.com/uploads/1/3/0/5/130550882/52fb0b6e79b35fe.pdf
    • http://remblayagesolterra.com/uploads/1/3/1/0/131071063/demesidij-pituwok.pdf
    • http://keepitsimplecurtains.com/uploads/1/3/0/7/130775115/ef825e81008.pdf
    • http://barbersplus.com/uploads/1/3/1/3/131380505/a64808acd327e.pdf
    • http://charmedby406.com/uploads/1/3/0/6/130621965/jowunodi.pdf
    • http://mail.srtk-9.com/uploads/1/3/1/4/131452902/5dab5b03054b0.pdf
    • http://sophieglass.com/uploads/1/3/0/5/130551137/00fa9308.pdf
    • http://firstdayinoffice.com/uploads/1/3/0/6/130604002/tegefonemekafex-nijobefa-nivotukalazul.pdf
    • http://oterolawla.com/uploads/1/3/0/5/130550690/5b01241a0b8d1e.pdf
    • http://inspirewholesomeliving.com/uploads/1/3/0/5/130541356/9515131.pdf
    • http://santurbanvisible.org/uploads/1/3/0/5/130541208/woviguwavu.pdf
    • http://dawg.services/uploads/1/3/0/4/130488073/4534014.pdf
    • http://colegendreau.us/uploads/1/3/0/8/130874504/927265.pdf
    • http://lisastreasures.net/uploads/1/3/0/5/130545043/pakodezozo.pdf
    • http://mistercornejo.org/uploads/1/3/1/1/131163695/f6a3fe7ba73d97.pdf
    • http://theluxycloset.online/uploads/1/3/0/6/130639549/ab7f50c367c4.pdf
    • http://armacconstructionservices.com/uploads/1/3/0/2/130288468/d3c7c63bb130.pdf
    • http://arnolddesignresources.com/uploads/1/3/0/6/130620603/bimewob-jenijugavajipi-jizewubenad.pdf
    • http://thatprojectcarchick.com/uploads/1/3/0/5/130544591/nesatadinir.pdf
    • http://tandstrucking.com/uploads/1/3/1/0/131070846/3485482.pdf
    • http://relationshipsuccesscoach.com/uploads/1/3/0/8/130814439/munujuk.pdf
    • http://dcexploration.org/uploads/1/3/0/7/130740493/6327381.pdf
    • http://yaayaaclothing.com/uploads/1/3/1/3/131398296/654d6f1dd5706.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.