Malicious PDF — malware analysis report

Static analysis result for SHA-256 0564c181bc3d9f5b…

MALICIOUS

PDF

40.0 KB Created: 2020-03-12 10:14:33 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4eaf32348045f38b317506338a821584 SHA-1: e829c43d0f874f90f72a88e8d651a6af772e5438 SHA-256: 0564c181bc3d9f5bec40290f92be41d914e6b2a31f29d57fb0e6891448d4fad6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links to other PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The embedded document body also contains a URL pointing to an HTML file, suggesting a potential redirection or further lure. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent, likely related to link farming or distributing secondary payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://host150.carmichaelnl.com/uploads/1/3/1/1/131164398/131164398.html#abcde+assessment+of+asthma
    • http://pascoemergencyservices.com/uploads/1/3/0/5/130551708/234861.pdf
    • http://consignonadime.biz/uploads/1/3/0/5/130589009/230610.pdf
    • http://shapenv.com/uploads/1/3/0/6/130639762/a4bc6ff02428c.pdf
    • http://smithsolarlab.com/uploads/1/3/0/8/130814459/7771371.pdf
    • http://www.dovecote-missions.com/uploads/1/3/0/9/130969322/e1aeb1d.pdf
    • http://www.mixbotanicals.com/uploads/1/3/0/2/130289792/gemibodezizim-guxujef.pdf
    • http://riessalesandservice.com/uploads/1/3/0/5/130542781/belup.pdf
    • http://gcsand.com/uploads/1/3/0/8/130874681/9247842.pdf
    • http://fabojer.store/uploads/1/3/0/5/130543569/7284415d3482.pdf
    • http://mdolinsky.com/uploads/1/3/0/3/130323126/pafadi.pdf
    • http://siddhearta.com/uploads/1/3/0/5/130543029/35d2f.pdf
    • http://mta-sts.luxorcabpeninsula.com/uploads/1/3/0/7/130739371/valepolarijan.pdf
    • http://flightsandfinedines.com/uploads/1/3/0/5/130588261/minamisoxota.pdf
    • http://webmail.greenmountaintreats.com/uploads/1/3/0/9/130969754/9421515.pdf
    • http://johnohare.net/uploads/1/3/0/7/130738628/829ac2.pdf
    • http://lashupwithneka.net/uploads/1/3/0/3/130379902/6950644.pdf
    • http://notourdayjobs.com/uploads/1/3/0/8/130813639/gotizekupe-legakudet-bukibegaladuv.pdf
    • http://barrons-independent.com/uploads/1/3/0/5/130589442/2339917.pdf
    • http://tvwithoutcable.com/uploads/1/3/0/6/130603779/2297693.pdf
    • http://juliebmassage.com/uploads/1/3/0/5/130550983/wapisuxetonoriradumo.pdf
    • http://worldcultureguide.org/uploads/1/3/0/6/130640053/3451777.pdf
    • http://jimmyplease.com/uploads/1/3/0/7/130739185/jiwoxumebudekig.pdf
    • http://thestyletaco.com/uploads/1/3/0/7/130775893/dozalum.pdf
    • http://puppypaws-k9.com/uploads/1/3/0/7/130739301/gabubigojosev.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072ed.bin
657bec0cb7a2b44d4bf5a3c8bb2ab3ee7b388e049bd8db35f0f329b376d0ab15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72ED 7764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.