Malicious PDF — malware analysis report

Static analysis result for SHA-256 f692dc2f81fcc350…

MALICIOUS

PDF

32.8 KB Created: 2020-04-07 12:57:16 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 03d768c8dca73181ed5f7cf97cb86ee8 SHA-1: 0721459194460727e616c4ebde58f117e087a9d7 SHA-256: f692dc2f81fcc350c668242066926a2e4919e2bbdf57575b32de147a29a92ad2
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used in SEO spam or link farms to artificially inflate search engine rankings. The document body text, while appearing to be a restaurant menu, is likely a lure to disguise the malicious intent of directing users to numerous unrelated external PDF files. The ML classifier strongly indicated maliciousness, supporting the assessment of a link farm attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://insightin2music.com/uploads/1/3/0/4/130483408/130483408.html#carta+restaurante+cielo+dragon+zaragoza
    • http://k12education.us/uploads/1/3/0/7/130776324/kunosuzuwe.pdf
    • http://marianhuberart.com/uploads/1/3/0/7/130739564/sawejodawi_pajuge_pinekoxitep.pdf
    • http://tmgspeed.com/uploads/1/3/0/3/130313252/5472870.pdf
    • http://shikareddy.com/uploads/1/3/1/1/131164067/054bf37cf.pdf
    • http://harryfilms.net/uploads/1/3/0/3/130379427/6672319.pdf
    • http://chrishenryforsecretaryofstate.org/uploads/1/3/0/6/130640092/rakojis-kewivefijobop-kozovorewadu.pdf
    • http://annemiekbailey.com/uploads/1/3/0/5/130588830/wemunorej.pdf
    • http://nadericlass.com/uploads/1/3/0/4/130436250/soxofeze.pdf
    • http://chosencarpet.com/uploads/1/3/0/8/130813314/pofejenukezuruv.pdf
    • http://littleantiquechinashop.com/uploads/1/3/0/9/130969083/9252512.pdf
    • http://celticessence.com/uploads/1/3/1/4/131437666/dezivotosupodex.pdf
    • http://tadoner.store/uploads/1/3/0/4/130490410/2427987.pdf
    • http://brainaneurysm.info/uploads/1/3/0/8/130814914/4754074.pdf
    • http://subprimalmeats.com/uploads/1/3/0/3/130379504/wufirujaxod.pdf
    • http://ineditmagazine.com/uploads/1/3/0/6/130620430/6391535.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000591a.bin
18199bf017e994099ca08b2214adc2caa7767a41e89e5acc501e9b050bed93e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x591A 7816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.