Malicious PDF — malware analysis report

Static analysis result for SHA-256 0082d7146e04cc00…

MALICIOUS

PDF

40.8 KB Created: 2020-03-25 12:23:29 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: bace66fdfd3943241cb1b2b12f17087a SHA-1: b17c56ba5b76cbd791c91700f84773b6a6efbb6d SHA-256: 0082d7146e04cc00bc720c1aa321674ab6c37c0ea709331cc50c177b4cd661dd
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document exhibits characteristics of a link farm or SEO spam, containing numerous links to external PDF files hosted on various domains. The heuristic 'PDF_SEO_LINK_FARM' and the ML classifier strongly indicate malicious intent. The document body, though partially obfuscated, contains URLs that are likely part of this distribution network.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://witherlysgreenhouse.com/uploads/1/3/1/1/131164442/131164442.html#new+english+file+pre-intermediate+cd+online
    • http://tonysaladinobaseballtournament.com/uploads/1/3/0/6/130620609/1683220.pdf
    • http://www.birdiesbakeryok.com/uploads/1/3/0/5/130588895/nubibekan.pdf
    • http://valleyrealestate-harrisonburg.com/uploads/1/3/0/5/130588679/bexuvem.pdf
    • http://dokkanaccountseller.com/uploads/1/3/0/5/130551351/fukikofow-daduk.pdf
    • http://www.ahenparty.com/uploads/1/3/0/8/130873922/8d1498bfa0.pdf
    • http://carlacarrolls.com/uploads/1/3/0/9/130970023/napavi.pdf
    • http://tripletreehomeimprovements.com/uploads/1/3/0/8/130813548/bc665c1c73bafa.pdf
    • http://blackcollective.com/uploads/1/3/0/9/130969177/wurifofu-mapixobatiku.pdf
    • http://www.hairts.com/uploads/1/3/0/7/130738550/ludapawulil.pdf
    • http://lionthink.com/uploads/1/3/0/6/130620927/wepeluda.pdf
    • http://figcoaching.com/uploads/1/3/0/5/130551267/3689515.pdf
    • http://decorationofhouses.com/uploads/1/3/0/5/130551599/tafem_juwon_majawafidanu.pdf
    • http://nomadicmichelle.com/uploads/1/3/0/2/130288441/gotuv_ludob.pdf
    • http://pinsontime.com/uploads/1/3/0/5/130550859/d8f4e4029.pdf
    • http://singingupsidedown.com/uploads/1/3/0/6/130640039/010d7b83.pdf
    • http://jennifertuten.com/uploads/1/3/0/7/130738951/7148392.pdf
    • http://bet365zenmetouzhu.br3h.com/uploads/1/3/0/7/130776103/kusolunixow.pdf
    • http://baolongyulechengwangzhi.br3h.com/uploads/1/3/0/5/130541641/705507.pdf
    • http://roundrockitconsulting.com/uploads/1/3/0/5/130538985/sukof-kirif.pdf
    • http://minnesotanoncompetes.com/uploads/1/3/0/5/130589241/supebinotizopuzoguse.pdf
    • http://tenzo.me/uploads/1/3/0/2/130291523/xapasu_bujisafoluta_lasajupufiwuned_wogezifi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007713.bin
b8a27de5816f50c4573d897f524fae2c7fb2c11481e0ab92f1dc024d88009c32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7713 7852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.