Malicious PDF — malware analysis report

Static analysis result for SHA-256 12a0c0bccc36713b…

MALICIOUS

PDF

41.4 KB Created: 2020-04-19 12:22:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ba70a6c7cdc9bcc6bbf7365b4e1f49be SHA-1: f01f3d576b90199e3e676bcd2adc8f2bdc41c6dc SHA-256: 12a0c0bccc36713b8bbb7b22eb3715389a0fc46faadf6fdf1757c139e57f3b78
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links to other PDF files hosted across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier strongly supports the malicious verdict, and the PDF structure itself is flagged for containing a mass of external links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abraxasroots.org/uploads/1/3/0/5/130543766/130543766.html#bahnw%C3%A4rter+thiel+analyse+pdf
    • http://coolingaround.com/uploads/1/3/1/3/131379759/40a6558555c9b3f.pdf
    • http://portlandartsacademy.com/uploads/1/3/0/6/130604656/sewoladude_dazase_rixojesez.pdf
    • http://la-jynne.com/uploads/1/3/0/2/130288729/zimudewepidixi-fovemarut-nevimetugijituw.pdf
    • http://hostmaster.successchoices.ch/uploads/1/3/0/3/130312964/6831687.pdf
    • http://icepickproductions-uk.com/uploads/1/3/0/5/130588951/8510999.pdf
    • http://sierrathunder.farm/uploads/1/3/1/1/131163783/tawafiliranipe.pdf
    • http://engine-filters.com/uploads/1/3/1/3/131379643/ec8ba22.pdf
    • http://bluegooseproperties.net/uploads/1/3/1/1/131163578/1509129.pdf
    • http://newlifelasersk.ca/uploads/1/3/1/1/131164013/67af61f5463c027.pdf
    • http://hrmarketingpartners.com/uploads/1/3/0/5/130551218/mokarujuragav-jisemolel-pufepanubofozob.pdf
    • http://r6north.com/uploads/1/3/0/7/130739463/81752.pdf
    • http://superherochallenge.org/uploads/1/3/0/4/130490399/3743396.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007852.bin
951b6ddd94b4cf2023a208c74c20f55878270c887487d5c03b4dc342e49deb31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7852 8432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.