Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8669cfc01023523…

MALICIOUS

PDF

36.9 KB Created: 2020-04-16 08:04:03 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 02864b035dabade6cd1f0058647b5967 SHA-1: 38c52cfc18bb73a914172c5c68b7a5eeead66bac SHA-256: f8669cfc01023523d0f9ace07131cc12dd3510c5bc2eaca1aa34e97f75df70f9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, many of which point to PDF files with numeric slugs. The primary link suggests a lure for 'audacity cracked apk'. This indicates a likely attempt to direct users to malicious or unwanted software downloads. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://val-lerieshairdesign.com/uploads/1/3/0/6/130621013/130621013.html#audacity+cracked+apk
    • http://alanruuska.com/uploads/1/3/0/3/130313536/bavodolapar-rajebufor.pdf
    • http://earlycollegehallco.org/uploads/1/3/0/9/130969876/xozoreziz.pdf
    • http://fortinpatent.com/uploads/1/3/0/3/130323624/fujolarogiza.pdf
    • http://pushthenote.com/uploads/1/3/0/8/130814003/1d7e33.pdf
    • http://floridafamilyresourcecenter.org/uploads/1/3/1/1/131163492/ladujexetu.pdf
    • http://flaccess.net/uploads/1/3/0/2/130291884/9395414.pdf
    • http://kyoora.com/uploads/1/3/1/4/131438617/2998139.pdf
    • http://modernbeautyworld.com/uploads/1/3/0/3/130323430/bd29167be3f8.pdf
    • http://mydigitalpresence.com/uploads/1/3/0/6/130620508/xovexe.pdf
    • http://milesaheadco.com/uploads/1/3/0/4/130489431/bevexukexeram.pdf
    • http://thewindingsheetoutfit.org/uploads/1/3/0/5/130540789/534705.pdf
    • http://cbdcompletehealth.com/uploads/1/3/0/6/130604175/suvijefemenigi.pdf
    • http://blanketwhale.com/uploads/1/3/0/6/130604838/vikotikose-dubefojanurop.pdf
    • http://blanketwhale.com/uploads/1/3/0/6/130604838/vikotikose-dubefoja
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000673f.bin
ad0ef91b0756422983c80791a3593ba00f9d30999303a1e620dd5b7c75d23dbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x673F 7932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.