Malicious PDF — malware analysis report

Static analysis result for SHA-256 05b316d33f3bc7a9…

MALICIOUS

PDF

57.1 KB Created: 2020-03-24 01:51:26 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 18dc0832af4c41e4fda49bfd8d83fd84 SHA-1: eb942a75a5cc235eb69fadf651b0f66afc09bed4 SHA-256: 05b316d33f3bc7a9e9b32e8aca69b76ab2db3bc560120e4e14e99b3676657e14
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. While no scripts were extracted, the sheer volume of links suggests a high likelihood of malicious intent, possibly to host further stages or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blink-182tributeband.com/uploads/1/3/0/2/130291971/130291971.html#illinois+per+mile+road+tax
    • http://phackett.piercehackett.ie/uploads/1/3/0/7/130738964/e109f2.pdf
    • http://ahgeneralbuilding.net/uploads/1/3/0/4/130477293/ba58920.pdf
    • http://jeffersonhigh.net/uploads/1/3/0/3/130323120/jalep_zewawef_rupojeneza.pdf
    • http://www.traciface.com/uploads/1/3/0/6/130621407/fojojatovikere_nuzij.pdf
    • http://www.epicprosauto.com/uploads/1/3/0/8/130874592/kusuku.pdf
    • http://hypno-van-den-brande-online.com/uploads/1/3/0/6/130620391/bc85bc574f2abd.pdf
    • http://silvervigor.com/uploads/1/3/0/6/130639227/eb4ce74.pdf
    • http://michelgaymard.com/uploads/1/3/0/7/130738622/lugabakisira.pdf
    • http://rhodescoloursfestival.com/uploads/1/3/0/6/130620248/c227240c8a08890.pdf
    • http://themcl.space/uploads/1/3/0/5/130551387/4592715.pdf
    • http://viclouis.com/uploads/1/3/0/6/130605338/vazoxabipobo-jovomifido-toled.pdf
    • http://218a4293p3rb.com/uploads/1/3/0/2/130289496/9159843.pdf
    • http://humansforclimate.org/uploads/1/3/0/8/130813818/lopemixigow.pdf
    • http://newvisionyouth.org/uploads/1/3/0/4/130489417/0c12484.pdf
    • http://runwildcle.com/uploads/1/3/0/7/130738939/sotizer.pdf
    • http://www.lookingforaneventure.com/uploads/1/3/0/4/130483469/ba8401.pdf
    • http://thenontech-techie.com/uploads/1/3/0/7/130740141/sifibusubutewokomen.pdf
    • http://tnmentalist.com/uploads/1/3/0/3/130313613/nimifemujudafil-terezafed-xofuxawezofo-vususo.pdf
    • http://mta-sts.alfredmontessori.com/uploads/1/3/0/9/130969158/mazefejudixopom-petozupezezodu.pdf
    • http://hobbylanthropy.com/uploads/1/3/0/5/130551635/nosaxumo-famif.pdf
    • http://scihm.net/uploads/1/3/0/6/130604226/6769633.pdf
    • http://panx.us/uploads/1/3/0/3/130379356/2338275.pdf
    • http://mercadohuanacaxtle.com/uploads/1/3/0/5/130539518/munuji.pdf
    • http://mycorporateteambuilding.com/uploads/1/3/0/6/130621506/lakejos_pevumukobix_xanigonesaze.pdf
    • http://matthewjacobyart.com/uploads/1/3/0/2/130271217/kefexudiliga.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b557.bin
64846777e1eb2b34fb931698cef4fdd0357a94278ecb1c5d6704c560265d2eb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB557 8608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.