Malicious PDF — malware analysis report

Static analysis result for SHA-256 09578f6c279fbfa1…

MALICIOUS

PDF

44.1 KB Created: 2020-04-06 15:19:11 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: bce1bed9aa4f7dd9165b4098076bccbc SHA-1: a6507689dad5dc07f3b88c2ec143aebf3c1b2483 SHA-256: 09578f6c279fbfa1de795754a8a0fa192cce4e703a286ac70fbd0bc2da3060c8
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document exhibits characteristics of a callback phishing scam, as indicated by the 'SE_CALLBACK_LURE' heuristic and the presence of URLs that likely lead to further malicious content. The document body contains a URL that appears to be a lure for 'Maui county motor vehicle registration renewal', suggesting a pretext for contacting the victim. The high number of external PDF links also suggests a link farm designed to distribute malicious content or improve SEO for malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://joshleephotojournalist.org/uploads/1/3/0/2/130272355/130272355.html#maui+county+motor+vehicle+registration+renewal
    • http://wolfgangthomas.com/uploads/1/3/0/7/130776808/89aa656e9.pdf
    • http://think-bliss.com/uploads/1/3/0/2/130289658/tidekixuvasak.pdf
    • http://bellahearttreasures.com/uploads/1/3/0/7/130775429/pegeb_rijajigog_rolurobawu.pdf
    • http://aewilliams75.com/uploads/1/3/0/7/130776346/nipuzagopujejoko.pdf
    • http://sofiatimotheou.com/uploads/1/3/0/6/130640208/fobitasonim-mitefujozuwit.pdf
    • http://compadresquadron.com/uploads/1/3/0/6/130640116/mopurudase-wufivepogevuxab-tilekenebexeno.pdf
    • http://gbinthemorning.com/uploads/1/3/1/3/131398573/vijarubewugexepo.pdf
    • http://sairusgrahamthille.com/uploads/1/3/0/4/130476579/6119cb6e8f4c812.pdf
    • http://themobilenotarysacramento.com/uploads/1/3/0/9/130969820/kozemagul-nubewe-jojesud.pdf
    • http://emmarea8.com/uploads/1/3/0/5/130588490/jezinageluzepul-pezozuku-vonebew.pdf
    • http://ssm-salekhard.ru/uploads/1/3/0/4/130477346/besedezokises.pdf
    • http://sunkissedtansbymolly.com/uploads/1/3/0/4/130488229/6d91153f77e6756.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000646e.bin
71ab1af044c2646d400aa0933cb5df614789ae92c4b975ca99b3718f472da111		 pdf-font-stream PDF embedded font (sfnt) at offset 0x646E 8264 bytes
font_01_sfnt_off00008488.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8488 2616 bytes
font_02_sfnt_off00008dbc.bin
7452b6b49b2d67df973eecb7580c7a2fe344bf55d7b957b3ade50b6969c50269		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8DBC 16068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.