Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc414ffa0a51d6a9…

MALICIOUS

PDF

38.3 KB Created: 2020-03-28 07:54:03 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9a56690fee76814db5f2b2bcceabdd38 SHA-1: cb2a1a143a4cf75cc3b1a3fc934d37905fa19469 SHA-256: fc414ffa0a51d6a97fda6bc0931dc5d87ad36a230f0523a85f20d77633a0f523
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection tactic. The ML_NYX_PDF_MALICIOUS heuristic strongly indicates malicious intent. The embedded URLs likely serve as lures to malicious content or further stages of an attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ecgcore.com/uploads/1/3/0/7/130776021/130776021.html#sonic+shake+sizes+in+ounces
    • http://origamipgh.com/uploads/1/3/0/7/130775365/roxojube.pdf
    • http://americanovisas.com/uploads/1/3/0/4/130488181/2762434.pdf
    • http://vwmtexas.com/uploads/1/3/0/2/130270826/836108.pdf
    • http://meredithharker.com/uploads/1/3/0/5/130551746/wonofor_zewiwaxemam_kabegotefosamo_jajixoboguwug.pdf
    • http://rootingwithyou.com/uploads/1/3/0/5/130551941/4531356.pdf
    • http://www.cadenbushell1.com/uploads/1/3/0/6/130604230/kuvefudatemesum.pdf
    • http://specialty-renal.com/uploads/1/3/0/5/130550768/dikiroxiko_gokasax.pdf
    • http://redsilkpro.com/uploads/1/3/0/4/130483194/kejuvimalipupi.pdf
    • http://offsite.studio/uploads/1/3/0/5/130541004/7759174.pdf
    • http://flourishmgt.com/uploads/1/3/0/4/130483806/fd3b9da6542.pdf
    • http://bellemoonvintageandwelshblankets.com/uploads/1/3/0/6/130620537/ba132c879.pdf
    • http://msxtech.net/uploads/1/3/0/7/130775762/5f7cb6e6162124.pdf
    • http://thegoodlifebiblestudies.org/uploads/1/3/0/2/130289284/fbeb55436d.pdf
    • http://www.bigdogpots.com/uploads/1/3/0/7/130740251/136751.pdf
    • http://dalal.la/uploads/1/3/0/4/130483184/58d4cd.pdf
    • http://startup-crypto.com/uploads/1/3/0/3/130312929/lalodi.pdf
    • http://voirin-bourgault.com/uploads/1/3/0/4/130435654/84ceeea3eb.pdf
    • http://www.lindensteamacademy.com/uploads/1/3/0/5/130539109/4e6628.pdf
    • http://sonjamitrovic.com/uploads/1/3/0/4/130436339/rubokito-pirenemenuwap.pdf
    • http://cpanel.wv469.com/uploads/1/3/0/8/130874523/1990159.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006bde.bin
2a3742ecb9fb2912caad3b849e9f6ecc4d3e4ff02ed645dd5eb88cbe1cb4e87d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6BDE 8232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.