Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff358b6501957415…

MALICIOUS

PDF

41.9 KB Created: 2020-03-14 21:14:56 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b58936618c27266a794ee20ee80da1c7 SHA-1: 775e91c5ae333782e44543c84993da22fd0de2c9 SHA-256: ff358b6501957415e19a07648cf42af2f2a7651d352d46eae025eee344afba17
92 Risk Score

Malware Insights

MITRE ATT&CK
T1598 Gather Victim Identity Information

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains text related to '3d cricket games for android mobile' and references to wkhtmltopdf, suggesting a lure for search engine optimization or to distribute further malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://indoorqualityaircody.com/uploads/1/3/0/8/130873818/130873818.html#3d+cricket+games++for+android+mobile
    • http://project-otaku.com/uploads/1/3/0/2/130288380/bipimuk.pdf
    • http://www.glenbrookfarm.online/uploads/1/3/0/4/130436054/651cc3315a0c8.pdf
    • http://mta-sts.mail.jacquesmichel.info/uploads/1/3/0/2/130287456/vewuwudiziputitajoje.pdf
    • http://cookthisweekend.com/uploads/1/3/0/5/130589315/jokagij.pdf
    • http://kkmedicalsharingservices.net/uploads/1/3/0/7/130775347/e4cf8ffe.pdf
    • http://www.cozycabinsva.com/uploads/1/3/0/4/130477719/a0213d4.pdf
    • http://www.immopreite.ch/uploads/1/3/0/4/130476432/9643390.pdf
    • http://officine.com.ph/uploads/1/3/1/1/131164425/9c7a1f9d15da844.pdf
    • http://positiveenergyny.com/uploads/1/3/0/7/130774981/abf13e7e.pdf
    • http://popebuster.net/uploads/1/3/0/4/130488294/xebixezifikegak_vajoridabedipod.pdf
    • http://pacificnwevents.com/uploads/1/3/0/3/130313213/sagovos_kujunida_filomuboxi_pipizo.pdf
    • http://www.bellahairtease.co/uploads/1/3/0/6/130620573/dapabazawuf_mupaw.pdf
    • http://simply-green-products.com/uploads/1/3/0/2/130289570/kewobusuwilovusorag.pdf
    • http://topcryptocurrency.com/uploads/1/3/0/6/130604129/3291601.pdf
    • http://my-living-benefits.com/uploads/1/3/0/4/130488195/5702501.pdf
    • http://sittingprettistylesextentions.com/uploads/1/3/0/6/130621019/tulapabawuluxu.pdf
    • http://monsieurpl.com/uploads/1/3/0/7/130775456/jewexeruz-nirix-demexodebusub-gavifiwomugop.pdf
    • http://earnware.info/uploads/1/3/0/5/130588220/xexis_tulokimi.pdf
    • http://runacrossky.org/uploads/1/3/0/8/130874179/nogufiseju_fetepobawekemuk_xizunofefabur.pdf
    • http://ww.lomboxnet.nl/uploads/1/3/0/6/130604758/0b38c313.pdf
    • http://il-australia.com/uploads/1/3/0/7/130739398/ravozeposifuteb.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007c3d.bin
3f3afd8cf523dbd88f5b9a61a4815d7f1d67102fc5be0f6103b0c6d1f37e724c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C3D 7648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.