Malicious PDF — malware analysis report

Static analysis result for SHA-256 fefc61cf53813cca…

MALICIOUS

PDF

41.6 KB Created: 2020-03-30 12:46:55 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c330c9ab455014c52b8aa3492155ee8d SHA-1: cae8d0369b1cda0059ffb70656629c3ae97390d8 SHA-256: fefc61cf53813ccad7325525dd4ebc64557682778e837aa41c1344aeefd29c4b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a URL that matches one of the extracted links. The ML_NYX_PDF_MALICIOUS heuristic also strongly indicates malicious intent. The primary attack pattern involves directing users to a network of external PDF files, likely for malicious purposes such as phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ashleyscustomcreationsboutique.com/uploads/1/3/0/2/130287514/130287514.html#ejemplo+de+un+marco+contextual+de+una+escuela
    • http://m2printing.com/uploads/1/3/0/4/130489567/62a4f697c726b9.pdf
    • http://mystudentadvocate.org/uploads/1/3/1/1/131164122/venivezivotisosibox.pdf
    • http://clusteredclosets.com/uploads/1/3/0/8/130874126/jadunuwatimufewebi.pdf
    • http://led-chicago.com/uploads/1/3/1/4/131406826/gonox.pdf
    • http://appraiserblaine.com/uploads/1/3/0/4/130483626/5722917.pdf
    • http://gelscan.net/uploads/1/3/0/7/130775127/fugezoruvu.pdf
    • http://jscompetence.de/uploads/1/3/0/9/130969458/kusari.pdf
    • http://anniebraselmann.com/uploads/1/3/1/3/131383586/74893e3.pdf
    • http://rykowskiandassociates.net/uploads/1/3/0/6/130604222/lixasej.pdf
    • http://pauldebruyne.eu/uploads/1/3/0/6/130621938/163522c39e4f.pdf
    • http://mshannahfreeman.com/uploads/1/3/0/7/130775310/ruvuk_mosigi_manewumipu_noredubuviwiju.pdf
    • http://brittanycandice.com/uploads/1/3/0/7/130740165/d6179.pdf
    • http://sidviciouscreations.com/uploads/1/3/1/4/131406930/dagirabubikepudoj.pdf
    • http://atlanticsubseatelecomltd.com/uploads/1/3/0/2/130272440/530a85eb.pdf
    • http://mcfarms.eu/uploads/1/3/0/5/130550789/4d72bca46a676.pdf
    • http://thatmarketinglife.com/uploads/1/3/0/3/130312986/sutex_taludoj.pdf
    • http://braidsareagirlsbestfriend.com/uploads/1/3/0/4/130436007/76d64e.pdf
    • http://intorecovery.com/uploads/1/3/0/3/130379135/xudux_movijavufakev.pdf
    • http://mdfenceanddeck.net/uploads/1/3/0/2/130271167/2036579.pdf
    • http://dottirsports.com/uploads/1/3/0/2/130288320/remenuwubaduxivawema.pdf
    • http://nhantienquocte-invietnam.online/uploads/1/3/0/4/130488220/mitifomesidode-kuvokix.pdf
    • http://uptownjerkyco.com/uploads/1/3/1/0/131070402/natawozawesaroz_luradexugi_vojozejititibad.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007598.bin
af3bc6679be62674d627de4010978659dbe94fdec2ddeab1b0b9e9ed62f886d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7598 9224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.