Malicious PDF — malware analysis report

Static analysis result for SHA-256 055d608d8a7db059…

MALICIOUS

PDF

35.9 KB Created: 2020-04-24 17:44:27 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 60796a53d49bcdfc68b9dc1c7bf12649 SHA-1: 01fe642411614c1a8d76dc5c070e7297f65e81ff SHA-256: 055d608d8a7db05989aa0bf9be943442a69284ad8ee5f45a81a8229e6829d05f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are structured as SEO-optimized PDF documents, indicating a link farm or redirection scheme. The document body, though partially corrupted, contains text suggesting it is a user manual, likely a lure to encourage users to click on the embedded malicious links. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://southdakotajewish.com/uploads/1/3/0/2/130271097/130271097.html#audi+a6+avant+2011+user+manual
    • http://texturedartyarneducation.com/uploads/1/3/0/6/130622068/2f064b2ac04.pdf
    • http://moresauce.net/uploads/1/3/0/6/130639017/lopoleketivakaw-welizalikapi-vexububonavi-tamoxijalulodu.pdf
    • http://rjfrankeandco.com/uploads/1/3/0/5/130541023/8253423.pdf
    • http://octopuswetsuit.com/uploads/1/3/0/7/130775176/8062757.pdf
    • http://colombiahomeservices.net/uploads/1/3/0/6/130604807/nutajokitusu.pdf
    • http://stitcheswithluv.com/uploads/1/3/0/6/130621451/zavovutomu.pdf
    • http://thelifestylelottery.com/uploads/1/3/1/4/131438825/3837720.pdf
    • http://tachmanagementsolutionsltd.com/uploads/1/3/0/4/130435711/juruzoki.pdf
    • http://prickettsfort.com/uploads/1/3/1/4/131409463/puputunide-pelut-mupes.pdf
    • http://thefarmhousebunn.com/uploads/1/3/0/2/130271159/90f732cf7a9b33.pdf
    • http://iesvschristians.com/uploads/1/3/0/8/130813851/nogex.pdf
    • http://420sports.net/uploads/1/3/1/3/131398449/4546538.pdf
    • http://unrestrictedimages.com/uploads/1/3/0/3/130379408/050cbf.pdf
    • http://angelandthebadmen.com/uploads/1/3/1/0/131069759/53d36d21.pdf
    • http://shadygrovemarket.org/uploads/1/3/0/7/130738914/ca907.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066ad.bin
edb096d8b889bb02b4eb792b28be7550d50d42d2a5c086ae1bbcb9ab324c7446		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66AD 7244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.