Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8bbff7093ffb603…

MALICIOUS

PDF

32.9 KB Created: 2020-03-17 15:17:57 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a77c627b1f11686c863a44eb8e04f63f SHA-1: fbeb306112c8b99309f1a4bcaeda69f1158652bf SHA-256: f8bbff7093ffb603e48ea2177ec084632a5bdc81507712d51891be38ff703b0e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to other PDF files on different domains. This behavior is indicative of a link farm or SEO spam campaign, likely intended to drive traffic or distribute further malicious content. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thehandypainterofchatt.com/uploads/1/3/0/6/130640155/130640155.html#welfare+capitalism+apush+quizlet
    • http://nenzhengqiandeqipai.br3h.com/uploads/1/3/0/5/130589123/1628885.pdf
    • http://centerforcouplesandfamilies.com/uploads/1/3/0/5/130540714/cd04b83.pdf
    • http://cincoranchpoolbuilders.com/uploads/1/3/0/7/130775912/4645462.pdf
    • http://perspection.net/uploads/1/3/0/6/130620604/953145.pdf
    • http://dalotyn.store/uploads/1/3/0/6/130605073/2188106.pdf
    • http://nelecreativegroup.com/uploads/1/3/0/6/130604637/f6b3ec8efe3afc.pdf
    • http://pagangarden.com/uploads/1/3/0/6/130620427/rajanawizebawap_vefop_mosefoniweb.pdf
    • http://tcjexporters.com/uploads/1/3/0/7/130740316/ridub.pdf
    • http://www.jennwatson.com/uploads/1/3/0/6/130639172/buxazujovukefaw.pdf
    • http://oldmcmickeysfarm.com/uploads/1/3/0/7/130739240/6f796c9b5f3.pdf
    • http://publictransportsolutions.net/uploads/1/3/0/5/130541313/golerukokenomopi.pdf
    • http://receptivefieldvfx.com/uploads/1/3/0/8/130874305/dodopewazibidesej.pdf
    • http://www.liminalspacearts.com/uploads/1/3/0/5/130589309/xoxerojorulew_vafob_sobubi.pdf
    • http://insighttribe.com.au/uploads/1/3/0/9/130969599/mejibaridaxutinev.pdf
    • http://terminal3.net/uploads/1/3/0/8/130813961/345d40a.pdf
    • http://www.brandexa.net/uploads/1/3/0/6/130603725/semozutupejod.pdf
    • http://eumexicosia.com/uploads/1/3/0/2/130272890/lozamutizaboxodawave.pdf
    • http://www.kaileecristinafilm.com/uploads/1/3/0/2/130289748/8110449.pdf
    • http://bubblesoccergeelong.com.au/uploads/1/3/0/8/130813859/7926179.pdf
    • http://redshiftbrewery.com/uploads/1/3/0/6/130604286/3599873.pdf
    • http://masterfuljourneys.com/uploads/1/3/0/9/130969701/wukif_jivoletalurev_mogiri.pdf
    • http://mail.oregonadvising.org/uploads/1/3/0/6/130620456/kodalobusume.pdf
    • http://www.lanesliquidation.com/uploads/1/3/0/5/130590678/migetazemasekajuj.pdf
    • http://www.generatable.com/uploads/1/3/0/3/130323491/wowevowo.pdf
    • http://www.perezwitt.com/uploads/1/3/0/3/130313194/3cf7d1b5379e.pdf
    • http://www.generat

Open this report in the interactive analyzer, or submit your own file for analysis.