Malicious PDF — malware analysis report

Static analysis result for SHA-256 07b40e271e0a5c4d…

MALICIOUS

PDF

41.7 KB Created: 2020-04-01 11:45:48 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4831256c53611a7d15ac652c438595ab SHA-1: a8e196b18fb1bf1627de18692ba9fbf2fee46d0d SHA-256: 07b40e271e0a5c4dd8f0cf9668da26d655b424ce4755edb0dbc19791b26543c8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links to various domains, identified as a PDF link farm. The ML classifier strongly flagged this PDF as malicious. The embedded URLs suggest a tactic to manipulate search engine results or distribute content from numerous compromised websites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://innofoil.ch/uploads/1/3/0/8/130874377/130874377.html#concepto+de+sufijos+y+prefijos
    • http://dwellcenter.com/uploads/1/3/1/4/131438162/bemuboxojo.pdf
    • http://hostmaster.groziomokslas.lt/uploads/1/3/0/6/130604983/3541057.pdf
    • http://charlestondrugdog.com/uploads/1/3/1/1/131163718/giruzudefigefuw_saputodun_gopur_samuziti.pdf
    • http://foxborooverheaddoor.com/uploads/1/3/0/9/130969483/2901533.pdf
    • http://mydnpmanuscript.com/uploads/1/3/0/6/130603858/5189a50802.pdf
    • http://cdhimpression.com/uploads/1/3/1/4/131409709/subutidezamuj.pdf
    • http://treelotcommunications.com/uploads/1/3/0/6/130604258/3722295.pdf
    • http://priyankahanumaihgari.com/uploads/1/3/1/0/131070306/b2817c53a8f27f8.pdf
    • http://renaldidelba.xyz/uploads/1/3/0/5/130544591/bepup.pdf
    • http://thewomensavenue.org/uploads/1/3/0/6/130639822/0f779b18cb.pdf
    • http://gradnx.com/uploads/1/3/0/6/130604541/dovotebilupode.pdf
    • http://toplineretrievers-west.com/uploads/1/3/0/2/130270934/gofefavoseluzotogira.pdf
    • http://mountainviewes.com/uploads/1/3/0/7/130776363/949d1df0eb.pdf
    • http://jansostylish.com/uploads/1/3/0/6/130639835/77ff223c02cb65b.pdf
    • http://oodelallyfarms.com/uploads/1/3/0/9/130969057/judoraguzejasemizix.pdf
    • http://greenbeansaves.com/uploads/1/3/0/6/130620950/b745260f9eb2.pdf
    • http://prestigetile.net/uploads/1/3/1/0/131069934/215b8ed.pdf
    • http://reallypost.com/uploads/1/3/0/6/130604499/rewexoxubanumuv-rodinuzekoval-gizubovupofe-lazomuwizabij.pdf
    • http://damonleitch.com/uploads/1/3/0/2/130271072/7044687.pdf
    • http://restorepronh.com/uploads/1/3/1/1/131163718/7965513.pdf
    • http://rstickann.com/uploads/1/3/0/6/130621321/fusijegotage.pdf
    • http://creedompublishing.com/uploads/1/3/0/5/130588701/45b086.pdf
    • http://pluspowerx.com/uploads/1/3/1/1/131164027/jufujez_dirikolazob_zurub.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007787.bin
e4b2e857d8bac9d6b007c25b7419a69687ccd7dd34b18284e319badeff0e6089		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7787 8804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.