Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d13f2caba1d70f0…

MALICIOUS

PDF

45.1 KB Created: 2020-05-25 03:20:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 15267009254373b3b02db58276d307df SHA-1: 78848c965f53ed3124b1c1a3213f335ecd90e00d SHA-256: 0d13f2caba1d70f0ea65ceddd820fbdb3c9a283d707955df6d00d759d4d71aa6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though heavily obfuscated, contains references to these URLs, suggesting a link farm or SEO spam campaign. The ML_NYX_PDF_MALICIOUS heuristic also strongly indicates malicious intent. The primary goal appears to be directing users to a network of external sites, potentially for further exploitation or malicious content delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://x0940502xstreamtravel.xsideas.com/uploads/1/3/0/4/130488195/130488195.html#sleeping+dogs+cheats+ps3
    • http://resonateheaven.com/uploads/1/3/1/0/131071286/dinesubabo_soguk.pdf
    • http://giveablegiggles.net/uploads/1/3/1/6/131606644/6583539.pdf
    • http://ddcustom1.com/uploads/1/3/0/6/130620480/nenokesi.pdf
    • http://altec-hn.com/uploads/1/3/1/4/131483185/pikumefo_gitedadusalif_notikunilu_nojarimovinop.pdf
    • http://cenlacpr1.com/uploads/1/3/0/6/130621815/3842878.pdf
    • http://vo2performance.com/uploads/1/3/0/3/130313215/godobivi_debunixasubese_kogakun.pdf
    • http://bqpainting.net/uploads/1/3/0/4/130489152/3af2cf.pdf
    • http://rootforcefitness.com/uploads/1/3/0/4/130476216/vofoduwutudot-guxofalukikaza-dizif.pdf
    • http://rockwellhousing.com/uploads/1/3/0/6/130639513/wazilemuxozopim.pdf
    • http://calvarychurchloveland.org/uploads/1/3/0/7/130740419/sozimuzi.pdf
    • http://jcphotoco.com/uploads/1/3/0/8/130814416/kogirupenolijukija.pdf
    • http://sophisticatedmercantile.com/uploads/1/3/0/3/130379232/596e05bea4a842.pdf
    • http://apps.highlandfairview.com/uploads/1/3/0/7/130776204/lalufejapupib.pdf
    • http://mta-sts.intensemedia.com/uploads/1/3/0/6/130620240/a0b18f5a23c0fe8.pdf
    • http://nospaganconsulting.com/uploads/1/3/0/5/130551943/zoditigutagol.pdf
    • http://kl-creation.fr/uploads/1/3/1/4/131437378/nenosipepuzi.pdf
    • http://jiangfu.shop/uploads/1/3/0/7/130739150/862f245a.pdf
    • http://nursecoin.com/uploads/1/3/0/2/130289225/jolodawokise_firosomoxoj_rewububazejuz_kifevu.pdf
    • http://trif3ctafit.com/uploads/1/3/0/2/130271080/vepasivo_xumulipofikid_tibiloloberaz.pdf
    • http://mta-sts.mail.clgagolf.org/uploads/1/3/1/4/131437352/gonexuzujita.pdf
    • http://custompropertysolutionsllc.net/uploads/1/3/0/8/130814868/mujoxegu.pdf
    • http://maine-wedding-photographer.com/uploads/1/3/0/9/130969953/6f6a0abdc1ea9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000836c.bin
1cca95ddb648be7470f9c15827eb9b14b9cd27cad32e9256a60e040595dce12a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x836C 10856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.