Malicious PDF — malware analysis report

Static analysis result for SHA-256 02847a7cf4eeaa02…

MALICIOUS

PDF

41.3 KB Created: 2020-03-21 11:28:44 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 83d75166b65b6ec77d044d78daf0dd74 SHA-1: 401fd321c147b90fb0709b9ca74fbb3da943f1ff SHA-256: 02847a7cf4eeaa02489ccb2f0898f402cae044dbe83d06c4da000d4f8a311330
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of external links to other PDF files hosted on various domains. This pattern is indicative of a link farm or a method to distribute malicious content under the guise of legitimate-looking documents. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rockandrowel.com/uploads/1/3/1/0/131071035/131071035.html#taiga+food+web+worksheet+answers
    • http://mail.gettoknowlasvegas.com/uploads/1/3/0/7/130740068/2f604db5b4b67.pdf
    • http://webdisk.voonann.com/uploads/1/3/0/4/130476054/biginubele.pdf
    • http://mitfit.net/uploads/1/3/0/4/130476221/1514ded24.pdf
    • http://septictankdesmoines.com/uploads/1/3/0/5/130588333/tuwotusetu_wulefara_zajewonopisiti.pdf
    • http://nwrealtybrokers.com/uploads/1/3/0/2/130289784/1547322.pdf
    • http://www.plentyoffishconfirmationpage.com/uploads/1/3/0/6/130604361/sopovovodonapatipa.pdf
    • http://www.matthewmicioni.com/uploads/1/3/0/7/130776585/2659965.pdf
    • http://beaverheadelectric.net/uploads/1/3/0/8/130813134/woragikinagepedigi.pdf
    • http://xn--cd-8h72a.to/uploads/1/3/0/7/130776393/7123987.pdf
    • http://midwestskiouting.com/uploads/1/3/0/9/130969470/9179c.pdf
    • http://myuntoldpleasures.com/uploads/1/3/0/6/130620423/4903d19.pdf
    • http://www.egschulzww2veteran.com/uploads/1/3/1/1/131164424/murepevogojoki.pdf
    • http://creepyen.com/uploads/1/3/0/6/130621800/bf140f834b4c1c1.pdf
    • http://tratamientointegral.net/uploads/1/3/0/2/130273814/632b944e90.pdf
    • http://howtodonewyorktours.com/uploads/1/3/0/5/130589163/vawezifunizu.pdf
    • http://proteus-mrighifu.net/uploads/1/3/0/8/130813747/vamuv_puxurimakesabu_zitozudilom_ranukobopavaka.pdf
    • http://cg-people.com/uploads/1/3/0/6/130639787/vawosa.pdf
    • http://www.healthybrowngirl.com/uploads/1/3/0/5/130589004/vetup.pdf
    • http://safehavensavings.net/uploads/1/3/0/4/130483847/pazorufonazegowete.pdf
    • http://arusticdream.com/uploads/1/3/0/2/130272619/5743732.pdf
    • http://thebra.org/uploads/1/3/0/7/130739284/2893668.pdf
    • http://dreamersandleaders.com/uploads/1/3/0/8/130874002/nerero.pdf
    • http://www.minneapolis1934.info/uploads/1/3/0/2/130288986/9241d.pdf
    • http://aesadministration.com/uploads/1/3/0/5/130550824/nolomoluse-vedetefuzafo-tojizim-zibudinopo.pdf
    • http://laroussitude.ca/uploads/1/3/0/4/130479312/nivegitejopogizudide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007772.bin
aed79432a6963dc46844e6357826b647a01b2f2e2ef133220a6ef8fc293cd3ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7772 8420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.