Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4345d946f703b3f…

MALICIOUS

PDF

57.9 KB Created: 2020-04-02 20:52:51 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9ca8b2b1b65453533c85531e78476848 SHA-1: a960469e49aa89de74e42c9e0b79fd78371f0c3f SHA-256: f4345d946f703b3f7676be2d27e2f1f8694b830cc7b5e3be2f2906e93dde8893
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a mass link farm, with numerous URLs pointing to other PDF files, indicating a likely SEO poisoning or spam campaign. The document body, though heavily obfuscated, contains references to 'Resume template canva' and the wkhtmltopdf generator, suggesting a lure to disguise malicious intent. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious PDF distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://finitoclothing.com/uploads/1/3/0/6/130639241/130639241.html#resume+template+canva
    • http://jewelrybystacey.com/uploads/1/3/0/9/130969546/fivip_mizexalis_xuxutebosekor_valirezowux.pdf
    • http://alumbite.org/uploads/1/3/0/7/130738526/mepufikufuvaxakar.pdf
    • http://kalosproduzionivideo.eu/uploads/1/3/1/3/131383515/ba0f5f3565.pdf
    • http://stgeorgecountrydancing.com/uploads/1/3/0/7/130740562/pafazuwan-jejisuxam.pdf
    • http://meta-physical.com/uploads/1/3/0/6/130639656/c93381.pdf
    • http://palmsopenproject.com/uploads/1/3/0/3/130313577/3849358.pdf
    • http://mta-sts.mx.transitionplan.org/uploads/1/3/0/3/130323997/f46b9.pdf
    • http://resolvefinancial.us/uploads/1/3/0/4/130488780/49213798cd.pdf
    • http://cybercentreforeducation.com/uploads/1/3/0/5/130588288/xujawurugiko.pdf
    • http://2000tractor.com/uploads/1/3/0/7/130740074/1c6bccf7.pdf
    • http://venomenterprise.com/uploads/1/3/1/0/131070843/konuderowizoti-ziroferakipa-geginepidebom.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b7cb.bin
8a8700548bb998e65b6107825f1a228780a2f4caf824239bfd9af3a75254e487		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB7CB 8628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.