Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e124643e620e1d2…

MALICIOUS

PDF

36.5 KB Created: 2020-04-02 10:48:36 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3b23d2ac75f94c4ee3198889b18d7312 SHA-1: 14e549758afafc2ebba8bb367fd12db893d6a9f3 SHA-256: 0e124643e620e1d261ba33415e153004897118f080b53c77b002f2f0284f9255
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files on different domains. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to distributing further malware or engaging in SEO spam. While no scripts were explicitly extracted, the nature of the links suggests a potential for JavaScript execution or exploitation to redirect users. The document body itself contains garbled text and URLs, reinforcing the malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-9166961-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9166961-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myopsconsulting.com/uploads/1/3/1/4/131454916/131454916.html#videos+de+batman+arkham+knight+pelicula+completa+espa%C3%B1ol+latino
    • http://eshoppy.us/uploads/1/3/0/6/130621431/23360.pdf
    • http://tridesigns.net/uploads/1/3/0/4/130488968/pawafisa.pdf
    • http://mcranch-tx.com/uploads/1/3/0/6/130639277/8831873.pdf
    • http://destinrentalbest.com/uploads/1/3/1/3/131380717/xawegulex_suzupulinokepu.pdf
    • http://dk-jackson.com/uploads/1/3/0/8/130874281/f40e7a7.pdf
    • http://riverjourneydance.ca/uploads/1/3/0/6/130603798/juzawesefo.pdf
    • http://thetickproject.org/uploads/1/3/0/5/130588944/wofaf-zexupi-xafekosase-fajelegevaz.pdf
    • http://notfadeawaymemoir.com/uploads/1/3/1/4/131407112/maruvakuwudufawizemo.pdf
    • http://shirley-hutchinson.com/uploads/1/3/0/5/130541445/gopotolizawov_xutof_nobogaret_jowunekeforoses.pdf
    • http://madtrucker.net/uploads/1/3/1/3/131378796/84c2f4.pdf
    • http://elndp.com/uploads/1/3/1/3/131380636/909683.pdf
    • http://michaelmangano.com/uploads/1/3/0/3/130323106/lagapebad.pdf
    • http://unfilteredonkloof.com/uploads/1/3/0/6/130604203/vevuvorokujinuvu.pdf
    • http://natalyacrespo.com/uploads/1/3/0/7/130775474/2291aa.pdf
    • http://elliottwheelerthelongtimepreview.com/uploads/1/3/0/7/130738846/6aa549fb81ee3.pdf
    • http://austynbaybeauty.com/uploads/1/3/0/6/130604568/b09525629d7ab.pdf
    • http://pigfig.com/uploads/1/3/1/4/131438453/4503499.pdf
    • http://2mrenovation.net/uploads/1/3/0/5/130590273/toxaxub-jokuriw-vomazazi.pdf
    • http://chasingjonah.net/uploads/1/3/1/3/131380094/f7184fb2.pdf
    • http://ascendsvcs.com/uploads/1/3/0/5/130589209/ae4b53a107d856.pdf
    • http://replayacademy.org/uploads/1/3/0/6/130603931/ralegutosuramexikof.pdf
    • http://saintsanonymous.org/uploads/1/3/0/3/130324170/difov_rokenaz_butode.pdf
    • http://patriotmedicalservices.net/uploads/1/3/0/3/130313178/b62d6177060ebf.pdf
    • http://spanoscustomupholstery.com/uploads/1/3/0/8/130874247/84b99a7d12ec.pdf
    • http://muziekcursusonline.com/uploads/1/3/1/4/131438175/xavosefusukifib.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006359.bin
8f6202741ba161cac6602efcfff5eba4c4f64a5a47958a7e4e7854e090d66591		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6359 7836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.