Malicious PDF — malware analysis report

Static analysis result for SHA-256 0967316a88523e1a…

MALICIOUS

PDF

50.0 KB Created: 2020-03-30 02:49:10 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4abb20eb27cb35b6e4d7732c0c61961b SHA-1: 2fe12f99753819e947e84665a08012e77cd835f6 SHA-256: 0967316a88523e1a74ad6abc575388b80d6b0e9840ca96f1688b4b6a2f46d2a0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating it's likely a dropper. The document contains a large number of embedded external links, characteristic of a link farm or SEO spam, which could be used to host further malicious content or redirect users to phishing sites. The primary attack vector appears to be exploiting the user's trust in document links to lead them to potentially harmful external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-9167222-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9167222-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mx.talbotspecialriders.org/uploads/1/3/0/7/130739964/130739964.html#penal+colony+kafka+pdf
    • http://colormeinkdesign.com/uploads/1/3/0/8/130873916/jinazukitatona_jumoron.pdf
    • http://connexus1.com/uploads/1/3/1/0/131071076/1750980.pdf
    • http://cairnsclassictours.com/uploads/1/3/1/3/131381428/165311.pdf
    • http://paulapoundstone.org/uploads/1/3/1/3/131380456/zazojag.pdf
    • http://systemskateboards.com/uploads/1/3/0/6/130620228/9602069.pdf
    • http://eatjook.com/uploads/1/3/0/5/130547207/67e38ea6f2c62.pdf
    • http://uniquitypt.com/uploads/1/3/0/5/130543059/zogavan_fevimabuxivaxog.pdf
    • http://originalpancakehousesavannah.com/uploads/1/3/0/8/130874519/eb334.pdf
    • http://liamriddick.com/uploads/1/3/0/2/130274256/lubon-vowoxujakij.pdf
    • http://rockoutscholarshipfund.com/uploads/1/3/0/2/130271057/d481226d.pdf
    • http://louisbuffparry.com/uploads/1/3/0/6/130604666/5565363.pdf
    • http://revisionfitness24.com/uploads/1/3/0/5/130550706/kikijaxenoge.pdf
    • http://healdsburgweddingguide.com/uploads/1/3/0/8/130814349/321880.pdf
    • http://michelewestlaken.com/uploads/1/3/1/4/131406809/tadomap.pdf
    • http://mirabalstylez.com/uploads/1/3/1/1/131164552/kajulikitibobetitini.pdf
    • http://digitalassetsolutions.net/uploads/1/3/0/4/130489706/3123587.pdf
    • http://improvemyattention.com/uploads/1/3/0/6/130639971/8d3f37605173e.pdf
    • http://beforeyoucloseyoureyes.com/uploads/1/3/0/6/130620494/nakadiw.pdf
    • http://banders.org/uploads/1/3/0/3/130312925/9243944.pdf
    • http://lunalashky.com/uploads/1/3/0/2/130273791/d8c17e954.pdf
    • http://sethspartanempire.com/uploads/1/3/0/8/130814338/3408777.pdf
    • http://amethystfitness.com/uploads/1/3/0/8/130814845/eb43925e883fd4.pdf
    • http://newelementkc.com/uploads/1/3/0/4/130488688/vavamifome.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000084c4.bin
d860cba914fb02bc787f96138555bbf1fab0b42409eeb04aef07a17473bbbccd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84C4 8364 bytes
font_01_sfnt_off0000a532.bin
0a97bde9752fdee1f3e7370c79030bd93fe90b264c0961419b1ed7afc578e67c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA532 16104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.