Malicious PDF — malware analysis report

Static analysis result for SHA-256 02a5433d9ee222b5…

MALICIOUS

PDF

43.2 KB Created: 2020-05-23 05:54:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bade239d9f973c889ce546361313a242 SHA-1: 19b78f42d99c7b52b4df49c253ca855baa3a1800 SHA-256: 02a5433d9ee222b5c394e2d57891b2a8b5c16dedc9ab3913d6761c91c19f1408
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which point to other PDF files, suggesting a link farm or a method to distribute further malicious content. The ML classifier strongly indicated maliciousness, and the heuristic firings confirm the presence of a link farm designed to host numerous external PDF files. The document body text, though partially obfuscated, contains keywords related to downloading books, which is likely a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grayselectricalservices.org/uploads/1/3/1/1/131164321/131164321.html#computer+awareness+book+pdf+free+dow
    • http://graffitiplus.uk/uploads/1/3/0/8/130874535/5b01e6886.pdf
    • http://keepittogether.ca/uploads/1/3/0/5/130550742/9998700.pdf
    • http://charityibc.org/uploads/1/3/0/8/130874122/7026709.pdf
    • http://tonysfabrics560.com/uploads/1/3/1/6/131607005/03d476.pdf
    • http://instaproducts.business/uploads/1/3/0/6/130603745/tiwujunazoganoniwubu.pdf
    • http://right-waytruck.com/uploads/1/3/0/4/130477090/seniwot.pdf
    • http://mariapaulagonzalez.com/uploads/1/3/1/6/131606331/58673062a3d.pdf
    • http://kidsstandforcharities.org/uploads/1/3/0/8/130814132/depivejosavigevexaso.pdf
    • http://dougansoriginal.com/uploads/1/3/1/3/131382257/vurifinexa.pdf
    • http://advisorsthinktank.org/uploads/1/3/1/4/131454143/debelatorerejo-resuj-lopiwibis.pdf
    • http://neptuneinvesting.com/uploads/1/3/1/0/131070098/c762673.pdf
    • http://lisa-lindsey.com/uploads/1/3/0/5/130551788/tabolejoresosuxit.pdf
    • http://gaugefilm.org/uploads/1/3/0/9/130968931/fusibiroragunus.pdf
    • http://2009nissan-murano-sl.com/uploads/1/3/0/2/130289179/wereke-banilewolom.pdf
    • http://hardyindustrialcenter.com/uploads/1/3/0/9/130969323/jopojipuvifotal-titimolo-luruboliru-fewojim.pdf
    • http://stylishjoker.com/uploads/1/3/0/3/130313320/f2a18cfd7.pdf
    • http://handynola.com/uploads/1/3/1/4/131453823/4043868.pdf
    • http://minnesotafutsalacademy.com/uploads/1/3/0/3/130313107/fagaxomag_wotimevu_mironobaresov_giwobedajebaj.pdf
    • http://willowoodinc.com/uploads/1/3/1/4/131453780/dotiguwixes.pdf
    • http://appliedintegrativeenergyhealing.com/uploads/1/3/0/6/130620673/9a8cba.pdf
    • http://opstrup.eu/uploads/1/3/1/3/131383269/sasoronese.pdf
    • http://conder.org/uploads/1/3/1/8/131857144/dcb7964b9.pdf
    • http://swimcabopools.com/uploads/1/3/0/3/130313336/125467c042e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007136.bin
33d80b5e357abfa3ea91f5eff18928953f8e36d8e9a7aea158c838e8ae756dd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7136 2116 bytes
font_01_sfnt_off00007aff.bin
df4ceb2ca35fa1d213dc30f38c57f1a2f2c60473685a962e8a8fb44cc051a5e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7AFF 10928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.