Malicious PDF — malware analysis report

Static analysis result for SHA-256 f497bd9cf7565833…

MALICIOUS

PDF

55.1 KB Created: 2020-04-15 03:43:22 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9cebe936e87cce02617ae4511be240b4 SHA-1: c38797fe5ef7db86cf46c990ffdbe04fba19d79b SHA-256: f497bd9cf7565833dcfc8b63bdd0cfb23b7cb43af6fa6328d1e12d5af80183f7
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file is identified as malicious by ML classification and heuristic analysis. It contains a large number of external links, many of which point to other PDF files hosted on similar domains, indicating a link farm or SEO poisoning tactic. The primary lure appears to be 'best love quotes in telugu pdf', directing users to a URL that likely serves as a gateway to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://7mm178.com/uploads/1/3/0/3/130379415/130379415.html#best+love+quotes+in+telugu+pdf
    • http://stuur-kracht.com/uploads/1/3/0/2/130291975/mabigukedupev.pdf
    • http://jdawgmusic.com/uploads/1/3/0/9/130969045/pilawusutoredudod.pdf
    • http://snchsummit.com/uploads/1/3/0/6/130621370/4816332.pdf
    • http://artstots.com/uploads/1/3/0/7/130775842/rulopenov_gurabuwipir_bakobu.pdf
    • http://protechgaming.net/uploads/1/3/1/4/131438766/4970917bb4.pdf
    • http://karlijanssen.com/uploads/1/3/1/4/131483275/7c1e4.pdf
    • http://wordbitten.com/uploads/1/3/1/4/131410606/fetosojupixizaritide.pdf
    • http://kalkulusconsulting.org/uploads/1/3/0/4/130488332/roludil.pdf
    • http://poiseandenvy.ca/uploads/1/3/1/3/131383493/suxiv_gatesezawe.pdf
    • http://lizzyandmike.com/uploads/1/3/0/8/130813987/nakidaso_wovun.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a5bb.bin
70d00ec8175f7c09ec34a30843967666a1c5e315f3bcded3157a8a51ae94682b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA5BB 8252 bytes
font_01_sfnt_off0000c585.bin
87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC585 2596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.