Malicious PDF — malware analysis report

Static analysis result for SHA-256 07893f692eadb430…

MALICIOUS

PDF

44.9 KB Created: 2020-03-27 04:54:59 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a306d4dd234b03cc1d463b1b42d5cc33 SHA-1: 0f23040428823f41ae7413d6eb9bf06533a32079 SHA-256: 07893f692eadb43019ce0fc3859714121a222ba07d345c70eede6adba4f2e9ca
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by an ML classifier and contains a large number of external links, indicative of a link farm. The document body, though partially corrupted, contains a URL that appears to be part of this link farm. The primary goal seems to be directing users to a network of external websites, potentially for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://windows-defender.com/uploads/1/3/0/8/130874403/130874403.html#senor+eres+fiel+y+tu+misericordia+es+eterna+letra
    • http://exposure.naturallyknown.com/uploads/1/3/0/8/130874474/kadotuvumurov_jogojijopax_tufuvezat_fevoz.pdf
    • http://goshoppinghere.com/uploads/1/3/0/6/130620356/1944129.pdf
    • http://murphyscafe.net/uploads/1/3/0/7/130738620/rumavejifamiza.pdf
    • http://dlrapartments.com/uploads/1/3/0/5/130539899/gibaxa.pdf
    • http://mattkey.ca/uploads/1/3/0/7/130775260/2b651.pdf
    • http://aggsolution.co.uk/uploads/1/3/0/4/130436224/29ea3c.pdf
    • http://vsupport.com/uploads/1/3/0/4/130489039/vavisefop-tezovigorem-kumebiduv.pdf
    • http://calljasonmyers.com/uploads/1/3/0/6/130639270/1171f63.pdf
    • http://stocktonclays.org/uploads/1/3/0/8/130874439/183219.pdf
    • http://www.khanhnguyencolorholic.com/uploads/1/3/0/5/130589137/gavisarixuvi_pemaga_vegiwi_marinonixaxuw.pdf
    • http://cameronbertrandvip.org/uploads/1/3/0/2/130289693/2f318d02e.pdf
    • http://greenoil-intl.com/uploads/1/3/0/4/130490776/zarexirigekupo.pdf
    • http://rivalrygraphics.com/uploads/1/3/0/5/130588902/radigad_dulaw_faxamudosigun_dikibad.pdf
    • http://life-cycle.net/uploads/1/3/0/5/130588459/tavonowe_segobofexot_zowile_wejasawalaxus.pdf
    • http://www.adentaaustralia.com/uploads/1/3/0/9/130969338/6973536.pdf
    • http://amslibrary.com/uploads/1/3/0/7/130739879/kemabufosutuninewado.pdf
    • http://jennanajjar.com/uploads/1/3/0/5/130590047/jegezeg-kazodakovarozo-rukegulo-xebedi.pdf
    • http://stmatthewstritons.com/uploads/1/3/1/3/131380343/7382e377.pdf
    • http://schmittwoodworkingllc.com/uploads/1/3/0/7/130775478/xebigojurep.pdf
    • http://supportamrinamin.com/uploads/1/3/0/4/130488498/nerexisolusojo.pdf
    • http://datasciencetitan.com/uploads/1/3/0/4/130475921/8040349.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e0d.bin
8fe219f0ad8dbcf9d85b77bd87bdf793e93c6b1b47f6222825abd88d2325f305		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E0D 8708 bytes
font_01_sfnt_off00008df5.bin
5ab722767a013402446fb9faea185d6eed51f18fc8590d020f5671b3499c51f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8DF5 16236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.