Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d779c46f565340c…

MALICIOUS

PDF

50.4 KB Created: 2020-04-24 12:05:01 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 008fbe519fb0516f2a868367c7e4203a SHA-1: d6bdbf5c63803c663116d2bb25887437f8ec4bd0 SHA-256: 0d779c46f565340cd698454691a290552f014f4e513ca03b56bb71a7fb27c4b2
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing campaign. The ML classifier also strongly indicated maliciousness. The presence of the string 'cUrl':'https://' within the document text hints at potential command execution or data exfiltration capabilities, possibly involving the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mapleshirefarms.com/uploads/1/3/1/4/131437312/131437312.html#baba+yetu+angel+city+chorale+pdf
    • http://write-order.com/uploads/1/3/1/3/131398515/d6431250e.pdf
    • http://tavagliones.com/uploads/1/3/1/3/131380741/2792550.pdf
    • http://bluewingstudio.com/uploads/1/3/0/5/130542852/d2d3153c1d6a.pdf
    • http://dfwtreecare.net/uploads/1/3/1/4/131413362/bodanozisadagoz.pdf
    • http://music-school.com/uploads/1/3/0/2/130272552/6506471.pdf
    • http://cheyennecoffeeco.com/uploads/1/3/0/4/130483564/3183539.pdf
    • http://kindredphr.io/uploads/1/3/0/2/130291646/jujikeza.pdf
    • http://nournournour.com/uploads/1/3/0/4/130476539/9056139.pdf
    • http://cameliascandles.com/uploads/1/3/0/4/130483632/2015656.pdf
    • http://fads4dads.com/uploads/1/3/1/3/131381602/481af.pdf
    • http://mynutritionar.com/uploads/1/3/1/3/131379236/5635018.pdf
    • http://camelotbrittanys.com/uploads/1/3/0/4/130493968/tiwebaxikulufumoj.pdf
    • http://kirkplayers.com/uploads/1/3/0/4/130488974/xurimuzufonivuluv.pdf
    • http://scrunchienation.com/uploads/1/3/1/4/131407807/genenojajifeguz.pdf
    • https://musescore.040000000000000000832667268468867405317723751068115234375
    • https://nocdn.com/static/musescore/scoredata/gen/6/7/8/1443876/ecf69ba9b174325c8cea4076bdcc9281f06db566/score_0
    • https://musescore.item-list:last-child
    • https://musescore
    • https://musescore.1
    • https://musescore.01000000000000000020816681711721685132943093776702880859375},{
    • https://musescore.[5
    • https://musescore.1000000000000000055511151231257827021181583404541015625},{
    • https://musescore.png@180x252
    • https://musescore.thefreelibrary.mid?revision=1495087261
    • http://www.-a0138447585
    • https://musescore.net
    • https://musescore.png@300x420?no-cache=1579255647&bgclr=ffffff
    • https://musescore.com\rThe
    • https://musescore.mp3?revision=1495087261&no-cache=1587719097
    • https://musescore.1000000000000000055511151231257827021181583404541015625
    • https://musescore...com/score/stats/view
    • http://angelcitychorale.com/user/3435351/scores/1443876
    • https://soundcloud.200000000000000011102230246251565404236316680908203125},{
    • http://www.com/static/musescore/scoredata/gen/6/7/8/1443876/ecf69ba9b174325c8cea4076bdcc9281f06db566/score_0
    • https://musescore.com/The+American+Tenors+Make+Their+Recording+Debut+on+Sony+Classical%3B+CD.0200000000000000004163336342344337026588618755340576171875
    • https://musescore.com/user/3435351
    • https://musescore.com/angelcitychorale
    • https://musescore.openx.thefreelibrary.com/watch?v=L-
    • http://www.com/user/3435351/scores/1443876
    • https://musescore.com/Mary+Chapin+Carpenter+Set+to+Perform+at+the+Democratic+National
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000098eb.bin
13c6cfbe0a4b635634a80f267664fd9bd129d2dab8517b4960700d347d1740e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x98EB 9756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.