Malicious PDF — malware analysis report

Static analysis result for SHA-256 021c8c7f8bf4c5a5…

MALICIOUS

PDF

37.3 KB Created: 2020-03-09 10:05:19 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e68934eb00d978163be7e760f746d58c SHA-1: b4c83b5ee229eef4dcd1fef53bda8b8c90992787 SHA-256: 021c8c7f8bf4c5a5ac2369e0054d063036b0480dbf64d81790615d916db8c636
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified as a 'link farm' by heuristics, suggesting a SEO spam or content redirection scheme. The ML classifier strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the embedded URLs like http://6iijoi.bdgct.com/uploads/1/3/0/3/130323806/130323806.html#microangiopathic+haemolytic+anaemia+blood+film are likely intended to lead the user to malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://6iijoi.bdgct.com/uploads/1/3/0/3/130323806/130323806.html#microangiopathic+haemolytic+anaemia+blood+film
    • http://chewoncakes.com/uploads/1/3/0/5/130539109/6652448.pdf
    • http://lakeforestcachamber.org/uploads/1/3/0/4/130476597/gafixana_pevosabojonag.pdf
    • http://pyramidskies.com/uploads/1/3/0/7/130776150/775670.pdf
    • http://elderlydigitals.youthdigital.com/uploads/1/3/0/8/130873810/tefowikowu.pdf
    • http://www.friendlyfeet.co.uk/uploads/1/3/0/7/130775166/bibogikobiven_ganafofujeg_lojumogi_rotolinowekol.pdf
    • http://cresslandbythesplash.com/uploads/1/3/0/3/130313529/vutemofevibido.pdf
    • http://alsfruittrees.com/uploads/1/3/0/2/130272340/6844363.pdf
    • http://elliott-wright.com/uploads/1/3/0/4/130435661/wemogawitepek-zurivef-gepinubepuve-tipuwupafa.pdf
    • http://www.ballroomuw.com/uploads/1/3/0/6/130639477/4a020abbeea0.pdf
    • http://propowerwashingllc.com/uploads/1/3/0/4/130483232/ea1af97.pdf
    • http://duomodigital.com/uploads/1/3/0/7/130776541/f275e.pdf
    • http://goodlandwine.com/uploads/1/3/0/5/130588928/turun.pdf
    • http://bli-testing.com/uploads/1/3/0/6/130639143/matut_bitotametokokan_galofuxok.pdf
    • http://truevinelifetab.com/uploads/1/3/0/7/130776594/rufaboxakovewabo.pdf
    • http://tinypawsadoption.com/uploads/1/3/0/2/130272898/fanan.pdf
    • http://municipalbondfraud.org/uploads/1/3/0/5/130551257/pesofosadop_wesoxifena_rudeboduruvapaf.pdf
    • http://casaraumdesign.de/uploads/1/3/0/6/130639709/rewatotadawudifem.pdf
    • http://nasr-nabiha.ca/uploads/1/3/0/5/130590682/ziwem_babelol_lapuxo_lesenafadojog.pdf
    • http://64-160-90-232.pacific-solutions.com/uploads/1/3/0/7/130775557/jitajavexot-pukox.pdf
    • http://trendyblocks.net/uploads/1/3/0/9/130969926/2bc4f.pdf
    • http://safermountains.com/uploads/1/3/0/6/130603887/lokivoju.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a7c.bin
1b087fe935d706eaa5370fb04da0dfa5971bcb8956ac261562c61958ba6616be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A7C 7728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.