Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff7576eb3284d00a…

MALICIOUS

PDF

47.9 KB Created: 2020-03-12 12:12:34 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a5a3ec61a9fb5f65cb00c43521ddd46a SHA-1: 66131b0a6f1e705efaf335d01060364f3bff5ab0 SHA-256: ff7576eb3284d00ac7fd59771f475d21a61a967720504b757438609fee2dff1a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links pointing to other PDFs hosted on various domains, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier strongly indicated maliciousness. The document body text, though partially corrupted, contains the phrase 'Plucking uke songs' and references the PDF creation tool, suggesting a potential lure or theme for the linked content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://autodiscover.coprimag.com/uploads/1/3/0/8/130874239/130874239.html#plucking+uke+songs
    • http://mydrivecash.com/uploads/1/3/0/6/130604414/1746a17c020e11.pdf
    • http://holeosensor.net/uploads/1/3/0/5/130539934/wodotopexaxexepaj.pdf
    • http://answersoperation.org/uploads/1/3/0/5/130588366/raneziloz.pdf
    • http://minnesotahistorymuseums.org/uploads/1/3/0/5/130550925/gotuzetigaligov.pdf
    • http://aqzsystems.net/uploads/1/3/0/6/130604191/32521.pdf
    • http://beachbumsrentalhut.com/uploads/1/3/0/5/130539033/xuxusoxokopowome.pdf
    • http://bradgoodsontutoring.com/uploads/1/3/0/6/130620752/tosaxujugoj_bixuvinu_bamopepomopi_xusige.pdf
    • http://thetacollective.com/uploads/1/3/0/5/130590157/fojuraborobad.pdf
    • http://gandkbuildingconstruction.com/uploads/1/3/0/8/130874680/kabuzibuneme_rekufoleja.pdf
    • http://barbariancrossfit.com/uploads/1/3/0/7/130739661/buzojesumasegilom.pdf
    • http://yardsocket.net/uploads/1/3/0/4/130489090/figamutubevaba_tularafobipo_fizuwediri.pdf
    • http://capitalfinancialplanningcharitablefoundation.com/uploads/1/3/0/2/130287521/tozusetum.pdf
    • http://classself.com/uploads/1/3/0/6/130604637/87c96b482f3a.pdf
    • http://csisecurityinc.com/uploads/1/3/0/6/130603741/8776722.pdf
    • http://familymarkets.org/uploads/1/3/0/5/130588542/2010077.pdf
    • http://adsl-66-121-174-46.encorp.net/uploads/1/3/0/2/130289458/6120132.pdf
    • http://ivflush.com/uploads/1/3/0/4/130488704/dibaseja.pdf
    • http://www.terrellconsultinggroup.com/uploads/1/3/0/7/130775269/zigoduvijagatun-xogoxademuki-binoruxebag-fuxolazij.pdf
    • http://proteinpantry.biz/uploads/1/3/0/7/130776168/3456095.pdf
    • http://www.kallakehomemaintenanceco.com/uploads/1/3/0/2/130272945/galurigilovuzamop.pdf
    • http://www.goldenehausnummer.com/uploads/1/3/0/4/130483286/kakiwepuwoxosa_vilom_tuwuxusamo.pdf
    • http://www.cheryltesslersolit.org/uploads/1/3/0/6/130639477/guros.pdf
    • http://nexcend.com/uploads/1/3/0/6/130639426/929004.pdf
    • http://painn2power.org/uploads/1/3/0/5/130551659/wukidewakiwakuk_sokevo.pdf
    • http://nexcend.c
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007b88.bin
0ad91cbf835821061f94634618e949ec8debd5349ab5048b93219afde95bfcde		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B88 8172 bytes
font_01_sfnt_off00009b3c.bin
5a0de9f0d8f131c7dcd80ef926154ce6f425b3eb9bbaa06b03861bf098f2d807		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B3C 16072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.