Malicious PDF — malware analysis report

Static analysis result for SHA-256 058b95c3ba71e8d6…

MALICIOUS

PDF

41.0 KB Created: 2020-03-29 01:47:24 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a00486430d907413306c4718cb49ac28 SHA-1: 214a0275ce565c48fddb6966f746ce7ddf817332 SHA-256: 058b95c3ba71e8d6bd12c6fa29f51721f4d5d9f403b473150cf5a2e722480652
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ML classifier strongly indicated maliciousness, and the presence of numerous external URLs supports a pattern of link farming or redirection. No scripts were extracted, but the document body and heuristics point to a malicious intent to drive traffic to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cecilyeiferle.com/uploads/1/3/0/5/130588246/130588246.html#como+hacer+un+asador+de+ladrillo+visto
    • http://www.wallisgateaux.com/uploads/1/3/0/8/130814329/wukomafodoras.pdf
    • http://www.novemberceleste.com/uploads/1/3/0/7/130775279/pumuwimumiwenu_jibukikosexo.pdf
    • http://getintheflowonlinecoaching.com/uploads/1/3/0/7/130774965/luzovizuluvopil.pdf
    • http://www.jake-silverman.com/uploads/1/3/0/4/130476678/zelavaz-suvugew-duxox.pdf
    • http://elescritorio.net/uploads/1/3/0/9/130969855/6650578.pdf
    • http://www.krowncues.com/uploads/1/3/0/2/130288320/folupavomitotup-dedovadoxawexu-linasoxisasobof.pdf
    • http://www.search.canustrealtyinc.com/uploads/1/3/0/6/130604182/5758439.pdf
    • http://feedyourmindretreats.com/uploads/1/3/0/7/130738637/9b63c4be741f.pdf
    • http://studentsfirstedu.org/uploads/1/3/0/6/130639703/fepexozizuguwa.pdf
    • http://paracordhut.com/uploads/1/3/0/5/130551132/voxuxile_pimin.pdf
    • http://hopefulwellness.com/uploads/1/3/0/5/130544746/magiroxije_bajubaj.pdf
    • http://learningmanifesto.org/uploads/1/3/0/7/130740464/196404.pdf
    • http://mrunderpriced.com/uploads/1/3/0/6/130639038/5194556.pdf
    • http://www.jocelynstcyrphotography.com/uploads/1/3/0/6/130621376/7819e0dbc3758f1.pdf
    • http://moneylifelessions.com/uploads/1/3/0/3/130324164/soriwel.pdf
    • http://whatdata.net/uploads/1/3/0/7/130740461/59295.pdf
    • http://interstatefive.net/uploads/1/3/0/6/130639959/kasovoge-wevizupisifaz-lisaxomaxopofev-wamuvivej.pdf
    • http://embracingthewaves.com/uploads/1/3/0/8/130874053/1058439.pdf
    • http://www.slinkylynxchic.com/uploads/1/3/0/6/130605399/xafofesax_xixatod.pdf
    • http://bongometer.com/uploads/1/3/0/7/130775606/8833364.pdf
    • http://ditchingthelifesuckers.com/uploads/1/3/0/6/130605422/pemokikatanaxibujevu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075c0.bin
805aaf96f7b5b9f722173b4a6a548bde2700bcebe5ebca13e439407c0d29a8ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75C0 8400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.