PDF malware analysis — malicious · 059a812b6c7d3d71

MALICIOUS

PDF

32.7 KB Created: 2020-06-02 06:57:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9d4f27c0b949b060985c9372272894eb SHA-1: 1bf8d6c7302ffb979313c3be805436e177e203f8 SHA-256: 059a812b6c7d3d71583c87c8cc60ab34dc2ec4ecaf2443370e078beec6334022

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document exhibits characteristics of a link farm or SEO spam, containing a large number of external URLs pointing to other PDF files. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic identified 26 external links, suggesting an attempt to manipulate search engine results or distribute content through a network of sites. The embedded URLs are likely part of this scheme, potentially leading to further malicious content or phishing attempts.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://forever-changed.com/uploads/1/3/1/6/131637209/131637209.html#baja+warrior+mini+bike+196cc+craigsl
- http://mta-sts.mxe.mokadelic.com/uploads/1/3/0/5/130543351/pamilusaroxetu.pdf
- http://mrandmrsmusicco.com/uploads/1/3/0/6/130603946/19603f55e9.pdf
- http://hemlockcanoe.us/uploads/1/3/0/5/130589360/gavadufe.pdf
- http://wolfcreekwildernessfarm.com/uploads/1/3/1/3/131384777/2280105.pdf
- http://slowgrinder.com/uploads/1/3/0/3/130379297/vesutopumer_bajosotulekik.pdf
- http://exmoorsec.com/uploads/1/3/0/6/130621479/ketem_japirukopupupax.pdf
- http://grandmasown.net/uploads/1/3/0/6/130605506/defanozivumeg-fenodetato-sififexofosizez-zonoxivumozo.pdf
- http://austinpaintingquote.com/uploads/1/3/0/8/130814145/fomoxuwejet.pdf
- http://forever-changed.com/uploads/1/3/1/6/131637209/terms.html
- http://forever-changed.com/uploads/1/3/1/6/131637209/dmca.html
- http://forever-changed.com/uploads/1/3/1/6/131637209/policy.html
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://vakaturisemo.files.wordpress.com/2020/06/wawivon.pdf
- https://pejiralitoke.files.wordpress.com/2020/05/vupuzobaratoguxazir.pdf
- https://sezorez.files.wordpress.com/2020/05/pilinugijurepeginili.pdf
- https://zadidepetox.files.wordpress.com/2020/05/49967317953.pdf
- https://ragowanelaz.files.wordpress.com/2020/05/mabijiwojegidewedij.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000054ee.bin` `8826963fd8b21ee6abdee7b2990b44ecf0b7000f4047c94db38c19775fecd205`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x54EE	9952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.