Malicious PDF — malware analysis report

Static analysis result for SHA-256 08309b61a8f59dc3…

MALICIOUS

PDF

40.8 KB Created: 2020-03-10 01:38:57 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ff72c972387f93e574ca5b7a3cc474f3 SHA-1: 3ba0099bb106b8e2848beb819cccc74e9d3ed681 SHA-256: 08309b61a8f59dc305a148f2e359f3fb1b89135c92cc8709b7b944bc464019b2
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO poisoning tactic. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document likely instructs the user to open a password-protected archive, a common method to bypass gateway security. The presence of embedded URLs and the ML classifier's high confidence score support the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gyrtn.bpmtc.com/uploads/1/3/0/4/130435711/130435711.html#manual+de+microsoft+access+2010+avanzado+pdf
    • http://randatantawi.com/uploads/1/3/0/2/130289577/7be2c.pdf
    • http://fxtltd.com/uploads/1/3/0/5/130543106/xuruwipab.pdf
    • http://www.teptu.com/uploads/1/3/0/6/130621700/158250.pdf
    • http://nilsravalvecoverracing.com/uploads/1/3/0/5/130539944/363c670cb339fb.pdf
    • http://10xintrapreneur.com/uploads/1/3/0/5/130550716/2c67a1.pdf
    • http://eutechsales.com/uploads/1/3/0/3/130379314/vuzajelukuwofo.pdf
    • http://gmztiresnewandused.com/uploads/1/3/0/8/130813967/mijimafanarijigiloji.pdf
    • http://www.dealelibrary.com/uploads/1/3/0/5/130539114/ximubikogan.pdf
    • http://oliviasjournal.com/uploads/1/3/0/5/130588721/3193266.pdf
    • http://virtualsaguaroapps.com/uploads/1/3/0/2/130289776/63618e8b.pdf
    • http://northernlakeschb.com/uploads/1/3/0/4/130488311/mixubokiputewax-kabur.pdf
    • http://www.chokeberrychai.com/uploads/1/3/0/5/130543870/9080671.pdf
    • http://nordbygdahandball.no/uploads/1/3/0/7/130740573/gugow-tasapo-manite-fikax.pdf
    • http://rollershadeiq.com/uploads/1/3/0/5/130550781/jaziki_kotubamaj_sakadoxukuxutu.pdf
    • http://nakitahogans.com/uploads/1/3/0/5/130588513/niluwazeson.pdf
    • http://orshaw.com/uploads/1/3/0/7/130739699/5193490.pdf
    • http://recordingstudiospokane.com/uploads/1/3/0/7/130738569/pafena_jikositavon_zazupesizulakaz_zigex.pdf
    • http://www.mhcsi-bath.com/uploads/1/3/0/3/130379485/9647e26c5ab8.pdf
    • http://www.lovebreastfeeding.com/uploads/1/3/0/5/130551179/f9c318ae3b6.pdf
    • http://stayprotected.org/uploads/1/3/0/6/130640003/0c5e4d01.pdf
    • http://speechertimes.org/uploads/1/3/0/5/130551491/saxiforobime.pdf
    • http://www.saba50.com/uploads/1/3/0/9/130969368/6839323.pdf
    • http://ahoconline.com/uploads/1/3/0/6/130603835/kuwif.pdf
    • http://ajna-massage.com/uploads/1/3/0/3/130313243/934389.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075a0.bin
bc72c1be6b41171bf5db19e455242f2b9732e402a0e294b20762ee09955bb0b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75A0 8832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.