Malicious PDF — malware analysis report

Static analysis result for SHA-256 00c9299270523233…

MALICIOUS

PDF

36.7 KB Created: 2020-03-22 11:55:36 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a5e598e20a254fbe517531c14d75a409 SHA-1: e490472fcd3c413ba9911ad4fe76d81712b0b470 SHA-256: 00c929927052323311482f5c40186d86c4db96ad17c70f7d1a95c08e1ddee476
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file contains a large number of external links, many of which point to similarly structured URLs on different domains. The primary URL, http://fortkortkortlaw.com/uploads/1/3/0/7/130738887/130738887.html#formacion+civica+y+etica+primero+de+secundaria+contestado, appears to be a lure for educational content. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to distribute malicious content across many domains. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fortkortlaw.com/uploads/1/3/0/7/130738887/130738887.html#formacion+civica+y+etica+primero+de+secundaria+contestado
    • http://solarpanelsflorida.net/uploads/1/3/0/6/130604539/fasukos-tadurovofik-tazare.pdf
    • http://reikievolution.org/uploads/1/3/0/9/130969499/1925284.pdf
    • http://thegreenbeingbakery.com/uploads/1/3/0/3/130324119/jotipokedapiriz.pdf
    • http://dpamedia.net/uploads/1/3/0/4/130478160/zixeno_rakopelepaw.pdf
    • http://windsonghouse.com/uploads/1/3/0/3/130312973/8147785.pdf
    • http://cumcosplay.com/uploads/1/3/1/1/131164234/remakak.pdf
    • http://foxriverperio.net/uploads/1/3/0/4/130476318/sixesapow-silunedol-mokilipabid-zalivuniz.pdf
    • http://spinaespresso.com.au/uploads/1/3/0/7/130775826/gipug.pdf
    • http://top10medicalalerts.com/uploads/1/3/0/5/130539319/mujediwifugo.pdf
    • http://notanotherpotcast.net/uploads/1/3/0/2/130272336/xajilap.pdf
    • http://utahphysicianloans.com/uploads/1/3/0/6/130639052/dorejufifes_wavab_lakotuto_valap.pdf
    • http://my.pulsarecharge.com/uploads/1/3/0/6/130620736/6740403.pdf
    • http://cwrwwtp.com/uploads/1/3/0/7/130740443/4409289.pdf
    • http://thegardencenterinc.org/uploads/1/3/0/7/130740049/virego-lumaturudifeje.pdf
    • http://josestacey.com/uploads/1/3/0/6/130622038/jesitakeruxon_gigawugidusis_kabafenos.pdf
    • http://jessebirdart.com/uploads/1/3/1/1/131163712/05ab7841b46634.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000674f.bin
be8ee216b1239ed4071547b8ddd5320008d5ea69c2a9903069997e9cbced08ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x674F 8284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.