Malicious PDF — malware analysis report

Static analysis result for SHA-256 0673f0c77fd8c72f…

MALICIOUS

PDF

40.5 KB Created: 2020-03-17 21:52:09 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 764f51a8dd55e2f2da6dc05e3a5e4395 SHA-1: 10991cca8df6f65cf3eee868c36b241a4bddbd35 SHA-256: 0673f0c77fd8c72f3b4d180ba29c4a9a146537392ccf7bb77196dacd9c600558
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document employs a link farm technique, embedding numerous URLs that point to other PDF files, disguised as a service manual download. This suggests an attempt to distribute malicious content or engage in SEO manipulation for malicious purposes. The ML classifier strongly indicated maliciousness, supporting the assessment of a phishing or content distribution attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://islamophoria.com/uploads/1/3/0/6/130604093/130604093.html#polaris+ranger+ev+service+manual+download
    • http://hunterscure.ca/uploads/1/3/0/7/130739007/kuzim.pdf
    • http://visionbystin.com/uploads/1/3/0/5/130538941/3144761.pdf
    • http://www.ellenlbarber.co.uk/uploads/1/3/0/5/130538990/roxupal.pdf
    • http://webmail.discusamerica.com/uploads/1/3/0/6/130605462/666328.pdf
    • http://ilovequeenslanderhouses.com.au/uploads/1/3/0/2/130291415/7993022.pdf
    • http://treebrook.com/uploads/1/3/0/6/130621178/lidujerenabu.pdf
    • http://foreverdudes.com/uploads/1/3/0/2/130288468/damilironu.pdf
    • http://livingmetroeast.com/uploads/1/3/0/6/130620362/1243142.pdf
    • http://justuschildrenbooks.com/uploads/1/3/0/9/130969931/c8effd8a8.pdf
    • http://huntersobsession.com/uploads/1/3/0/7/130738812/21d9adab.pdf
    • http://wind-surfing.com/uploads/1/3/0/5/130590399/punumavumiz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000768f.bin
03d69557b420fdfbc7d8ac93277e06690fe1d6916d5648ba175e836314ce5bc5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x768F 7196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.