Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e71a4615725837a…

MALICIOUS

PDF

80.4 KB Created: 2020-03-24 03:59:43 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 15c84223e8bd609fa0c7d4fe82096ad2 SHA-1: 54c77a2685fa12c10ae05a1c57712196743e48b0 SHA-256: 0e71a4615725837a692ded0ba342e9880050201fa43e20cb02d44a20a9c10367
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDF files, indicating a link farm or SEO manipulation tactic. The document body, though partially corrupted, contains a title related to communication, which is likely a lure to encourage clicks on these external links. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external URIs supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://audiofidelity.no/uploads/1/3/0/4/130435783/130435783.html#porque+es+importante+la+escucha+activa+en+la+comunicaci%C3%B3n+telef%C3%B3nica+eficaz
    • http://www.mzteachuh.com/uploads/1/3/0/7/130738997/xofazazopu.pdf
    • http://marlievipond.com/uploads/1/3/0/6/130620808/6392297.pdf
    • http://techmasterj.shop/uploads/1/3/0/8/130874316/1986634.pdf
    • http://discovercalmness.com/uploads/1/3/0/6/130620687/jalabolopekogokube.pdf
    • http://endthedeer.com/uploads/1/3/1/0/131070374/8bf249abf67.pdf
    • http://poshcashhub.com/uploads/1/3/0/5/130541356/6155347.pdf
    • http://findmoreroom.com/uploads/1/3/0/4/130483986/8e19dfc5.pdf
    • http://piecesoftimewest.com/uploads/1/3/0/8/130813732/famidoraf_vaziketo_mufus.pdf
    • http://dominicbercier.com/uploads/1/3/0/2/130272902/nozuwa.pdf
    • http://debbieelliswatercolours.com/uploads/1/3/0/5/130588841/revawow.pdf
    • http://ongfaba.fr/uploads/1/3/0/8/130813373/tizuzovofazi.pdf
    • http://timings.ca/uploads/1/3/0/8/130814460/8dc38477a8.pdf
    • http://projektapple.com/uploads/1/3/0/9/130969429/gujoxuseletok.pdf
    • http://999fmradiomanila.com/uploads/1/3/0/6/130639471/loparovorako-xobumag.pdf
    • http://www.theclubhousegallery.com/uploads/1/3/0/5/130543798/42a84597f8.pdf
    • http://webdisk.redlineinstallers.com/uploads/1/3/0/8/130874025/nukibivixit.pdf
    • http://ryancayabyab.info/uploads/1/3/0/7/130739463/7702910.pdf
    • http://corkandcrownjax.com/uploads/1/3/0/5/130552073/1907234.pdf
    • http://unguiltylifestyle.com/uploads/1/3/0/6/130639873/wipebovapu.pdf
    • http://justin.technology/uploads/1/3/0/5/130588701/3214736.pdf
    • http://abetterbc.com/uploads/1/3/0/7/130738755/ligugazepuxodax.pdf
    • http://www.noellecavenaughyoga.com/uploads/1/3/0/4/130476605/nogamagu-loguwokepi-xejokuzakanibu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000deb0.bin
1957428794578a072b8983e864e5701b52391162abfb2d6d14c6295fa8a16687		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEB0 6444 bytes
font_01_sfnt_off0000ee72.bin
032fc05d25e8f12e76243e70df0b535a93ba9e2f5b612f4d84ab350bad878789		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE72 9376 bytes
font_02_sfnt_off00011014.bin
87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11014 2596 bytes
font_03_sfnt_off00011932.bin
99c5a563bd14079918bfffdbdfd95054cabbef0c47e0e3eb61f716c3cd559389		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11932 16124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.