Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff261671552e786f…

MALICIOUS

PDF

49.9 KB Created: 2020-04-02 10:06:21 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b10ef34c15ce49b7e0c8592d1c545478 SHA-1: c5373946daa840708c9ed2280ede78758bf4a95a SHA-256: ff261671552e786fef5743068cb9f38e3173a490e5484d6dd3f5eafcbe5ca8d8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a URL that points to a PDF file. The ML classifier also strongly flagged this PDF as malicious. The primary attack pattern appears to be a link farm designed to redirect users to numerous other PDF documents hosted on various domains, potentially for SEO poisoning or to distribute malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://headblocks.org/uploads/1/3/0/3/130379407/130379407.html#que+significa+servidumbre+de+transito
    • http://unitecno.org/uploads/1/3/0/5/130543010/gixoges.pdf
    • http://laxapartments.com/uploads/1/3/0/5/130589217/bilavapetejig.pdf
    • http://pairblymedia.com/uploads/1/3/0/5/130589218/lusudemixitanodug.pdf
    • http://brmelectro.com/uploads/1/3/0/2/130288318/49f83a826bbe1.pdf
    • http://mtmsmusic.com/uploads/1/3/0/2/130291658/zomibalazowepujuku.pdf
    • http://pathpublications.com/uploads/1/3/0/7/130775510/wenefijamajitagal.pdf
    • http://kalina-chung.com/uploads/1/3/0/7/130740013/5381678.pdf
    • http://raesalon.com/uploads/1/3/0/5/130552073/gudinivejip.pdf
    • http://vintagehomegreensboro.com/uploads/1/3/0/8/130873916/d81f61d.pdf
    • http://windlassyachtsales.com/uploads/1/3/0/6/130620375/252332.pdf
    • http://californiacreativecounselingcenters.com/uploads/1/3/0/5/130589179/1370171.pdf
    • http://laurasfoundation.com/uploads/1/3/1/1/131164023/1752116.pdf
    • http://heartsofjustice.org/uploads/1/3/0/8/130873986/keviwimosulojem.pdf
    • http://timetrails.com/uploads/1/3/0/4/130483270/8714040.pdf
    • http://askjimmycarter.com/uploads/1/3/0/6/130620427/59cff8.pdf
    • http://simplygreathearts.com/uploads/1/3/0/5/130539432/pajuzan_visosadov.pdf
    • http://plateauhelmets.com/uploads/1/3/0/5/130590158/fuvabemod.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007981.bin
9fb1e214f6518d4022973f3eaabb141807dba018bd246a1465a50a19ce799e76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7981 9016 bytes
font_01_sfnt_off00009a2e.bin
6dc6e07f93ae70488a19e8a398a1c6cda2f5723fc3d3cbe180c5afbb10c3611e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A2E 2864 bytes
font_02_sfnt_off0000a445.bin
ff8fb627f3d0dd9997bbf5f8e67d75ba984810f76280c6dead7bf9ae512bf231		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA445 16096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.