PDF malware analysis — malicious · 095cf33e239e8def

MALICIOUS

PDF

37.8 KB Created: 2020-05-19 19:43:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6c87e01d922555807313e19aada2298e SHA-1: 6a384c3ebfae4c4aa697c0b711783a125e173860 SHA-256: 095cf33e239e8def66731fbc9dd83a5410c05d2e9adcd64043ce4a966981c434

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which appear to be generated for SEO spam purposes. The document body, though partially corrupted, contains a URL that also points to a sales listing, suggesting a lure to external malicious or spam content. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://twistedsugarut.com/uploads/1/3/0/2/130287281/130287281.html#raptobike+lowracer+for+sale
- http://renovatioremodeling.com/uploads/1/3/0/5/130588185/nosid.pdf
- http://prodigiumrecruitment.com/uploads/1/3/1/3/131398386/56873ae3.pdf
- http://steamplayground.org/uploads/1/3/0/2/130270845/5f73769a.pdf
- http://hollowdolls.com/uploads/1/3/0/2/130273743/mudig_dedifezefep.pdf
- http://theblackcatlounge.net/uploads/1/3/1/4/131438453/bitame_nekuvili_pobixesafozedel_rokudenubuj.pdf
- http://angelssandlot.com/uploads/1/3/0/5/130539553/edf686.pdf
- http://cleverfamilyhomes.com/uploads/1/3/0/6/130640227/tokamadevoza_zitegezedig.pdf
- http://jonathan-watson.com/uploads/1/3/1/8/131859527/zurixesi.pdf
- http://barnowskifg.com/uploads/1/3/0/7/130739919/a099f99fa803.pdf
- http://viqueenofficial.com/uploads/1/3/0/4/130488365/3836722.pdf
- http://harvestclevelandne.org/uploads/1/3/1/3/131384679/5525335.pdf
- http://willamettevalleybookkeeping.com/uploads/1/3/0/9/130968915/7223697.pdf
- http://gr8lifeministries.org/uploads/1/3/0/6/130620781/3c16474a9b.pdf
- http://drfrancineweston.com/uploads/1/3/0/8/130874422/b6c20.pdf
- http://jakedweber.com/uploads/1/3/0/7/130776078/dobiresabuvud-bevaranaxa-manimisiparug-nefazo.pdf
- http://plushplus.net/uploads/1/3/0/7/130776678/tafepaza-nuwiti.pdf
- http://europe-clinic.net/uploads/1/3/1/4/131482915/bovapat.pdf
- http://friendsoflcas.com/uploads/1/3/0/4/130492963/8eaff3b142fdc69.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000066ad.bin` `c9eac5edb2ce314b8dd58f2195104bf2a7015cb82a8264cb0688efef18345574`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x66AD	10436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.