Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbe51862fcd17434…

MALICIOUS

PDF

37.2 KB Created: 2020-03-11 13:19:56 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: af56ce1c11e3a2282343ef333c68ffa6 SHA-1: 46072cd201575e622ddb5f23c715474ec58e0e10 SHA-256: fbe51862fcd17434f2ddb90016b5d1720d191530fbdb5b6ee25ace96e1e7bfe2
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF contains a large number of external links, a common technique for SEO poisoning or redirecting users to malicious sites. The PDF_SEO_LINK_FARM heuristic firing indicates a deliberate attempt to create a link farm. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the presence of numerous external URLs suggests a phishing or content-luring attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://host3.carmichaelnl.com/uploads/1/3/0/5/130551434/130551434.html#permenkes+no+12+tahun+2012+tentang+akreditasi+rumah+sakit
    • http://simpleeating.net/uploads/1/3/0/5/130540604/mepatawakejikukek.pdf
    • http://mta111.qualitynow.net/uploads/1/3/0/7/130775245/4047203.pdf
    • http://www.fudgejj.com/uploads/1/3/0/5/130588494/1ba053b18bc.pdf
    • http://efa.ms/uploads/1/3/0/3/130379163/e02e8.pdf
    • http://consciousmindset.org/uploads/1/3/0/2/130289198/liwafodiz.pdf
    • http://theentitydoctor.com/uploads/1/3/0/5/130540286/9302032.pdf
    • http://www.sendemfrankie.com/uploads/1/3/0/5/130539838/ad8b4f2cb.pdf
    • http://powerhousehoops.net/uploads/1/3/0/8/130874077/latekopukixivuf.pdf
    • http://storgebhs.com/uploads/1/3/0/6/130640183/aa61b09ee783.pdf
    • http://www.kendrascookiesonline.com/uploads/1/3/0/7/130739061/zidebofep_memawo.pdf
    • http://applecommercialre.com/uploads/1/3/0/6/130604939/6301679.pdf
    • http://dreamasweetdream.com/uploads/1/3/0/3/130323232/zesulaxije_timavonojadiku_rusulozimu.pdf
    • http://advocateproject.org/uploads/1/3/0/7/130776578/7607150.pdf
    • http://acupunctureexpress.com/uploads/1/3/0/5/130550742/6574756.pdf
    • http://www.heisaworm.com/uploads/1/3/0/5/130550708/6937078.pdf
    • http://mewantemooseicdayglasgow.com/uploads/1/3/0/7/130738534/vagukogabixuzunu.pdf
    • http://www.unioresidences.com/uploads/1/3/0/2/130289429/zerotolano.pdf
    • http://tinathaimassage.com/uploads/1/3/0/9/130969330/0c2eed.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006967.bin
a79578ebca620b3a84ac9b63506161b1c5f57056a22b839668c700ec8ee289f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6967 7544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.