Malicious PDF — malware analysis report

Static analysis result for SHA-256 084852d0f1c1799a…

MALICIOUS

PDF

41.7 KB Created: 2020-03-10 03:14:51 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: cf2c0703515d10aa43b28b43b13cf880 SHA-1: f4f80520e5558b47184fc2db9a543a7084967891 SHA-256: 084852d0f1c1799af4e9279d8effc47d45840eb05c421c3d0457acd3f3fdfd8b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary external URL points to a page discussing ukulele strumming patterns, which is likely a lure. The ML classifier strongly indicates maliciousness, and the sheer volume of links suggests a link farm or redirection scheme designed to lead users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://armstrong-family.rominastiebenphotography.com/uploads/1/3/0/7/130775164/130775164.html#uke+strumming+pattern+for+count+on+me
    • http://shore2delight.com/uploads/1/3/0/3/130323674/5200398.pdf
    • http://detroitfollowersofchrist.org/uploads/1/3/0/3/130379435/ea21c17553592.pdf
    • http://juliawrites.com/uploads/1/3/0/6/130620853/duzofedubakuvepanu.pdf
    • http://ltcstaffinginc.net/uploads/1/3/0/7/130775918/ganeguzojubox.pdf
    • http://www.hairbychelseynicole.com/uploads/1/3/0/7/130740438/bakote_lobijuxivugozes_kipixin_fijamil.pdf
    • http://aixent.biz/uploads/1/3/0/5/130544725/basewexozapijonome.pdf
    • http://test.munkireport.mrazamerine.com/uploads/1/3/0/2/130271226/6892958.pdf
    • http://vacaspa.com/uploads/1/3/0/7/130776215/sekuvutu_zigone.pdf
    • http://mx.newhavenzen.org/uploads/1/3/0/5/130588668/6885569.pdf
    • http://instrumentperdu.com/uploads/1/3/0/6/130621388/9081905.pdf
    • http://ministrystudy.org/uploads/1/3/0/6/130621178/e35c0a5a7.pdf
    • http://bigskyalchemy.com/uploads/1/3/0/5/130590399/5995431.pdf
    • http://nicoleraucheisen.com/uploads/1/3/0/4/130488251/fepotet-rikovadotera-gonovaket-pisuvibozodop.pdf
    • http://benkatzactor.com/uploads/1/3/0/2/130289652/bexef.pdf
    • http://gellabeautyco.shop/uploads/1/3/0/5/130544136/44b2a1d6d1d4c0.pdf
    • http://tampabayplasticsurgery.net/uploads/1/3/0/7/130740055/7242941.pdf
    • http://catholic-con.com/uploads/1/3/0/7/130776824/f414b81.pdf
    • http://canariasrural.net/uploads/1/3/0/2/130272606/musosi_tolaxuvim_maxixuparoduke.pdf
    • http://interstatefive.net/uploads/1/3/0/6/130622036/juzuzexidaza_xazabewujubef_tajab.pdf
    • http://mta-sts.babydreamsmc.com/uploads/1/3/0/3/130379377/d6b6c.pdf
    • http://brutalproxies.com/uploads/1/3/0/2/130289283/b4f94f2b033912.pdf
    • http://acceleratecleaning.com/uploads/1/3/0/5/130550749/5961431.pdf
    • http://everything4cell.com/uploads/1/3/0/6/130621084/kabaxanarom-batuge.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000078ce.bin
4f79ef753f8bdc2b4dd4c290ee3701e6814f86757916b3df9d3b27143cd92eb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x78CE 8376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.