Malicious PDF — malware analysis report

Static analysis result for SHA-256 12a764582d6011d0…

MALICIOUS

PDF

78.5 KB Created: 2020-05-20 18:47:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c8679f29b3e0a3805e5abb98d4735f0e SHA-1: 6f31c07afe68757d032f4733297fabe7d4db8f82 SHA-256: 12a764582d6011d08c161b0c71829d59d6a7ab219cdf8b132ffca55a08a0d7d8
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary link points to http://additionmeddevicetalentsolutions.com/uploads/1/3/0/2/130291499/4927673.pdf, suggesting a redirection or content delivery mechanism. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the extensive link farm indicates a likely attempt to distribute further malicious content or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alfafencing.net/uploads/1/3/0/6/130639244/130639244.html#%25D8%25B9%25D8%25B1%25D8%25B3+%25D8%25A3%25D9%2588%25D9%2585%25D8%25A7%25D9%2587%25D8%25A7+%25D9%258A%25D8%25B8%25D9%2587%25D8%25B1+2015
    • http://thethotcloset.com/uploads/1/3/1/3/131398362/tisejamagibir.pdf
    • http://westernjules.com/uploads/1/3/0/7/130776254/xoxomenudedivo.pdf
    • http://thefreedomincubator.com/uploads/1/3/0/2/130287419/tikitawapowox.pdf
    • http://maoridj.com/uploads/1/3/0/6/130639888/wovisosojivagik-jurod.pdf
    • http://skaffchiq.com/uploads/1/3/0/2/130291623/487c7c6f771.pdf
    • http://bornreckless.co/uploads/1/3/1/6/131606509/wejivugozabasas.pdf
    • http://sweetmaplecafe.co/uploads/1/3/0/2/130273623/mozobagaguju.pdf
    • http://sensorystore.net/uploads/1/3/0/2/130287972/5273290.pdf
    • http://weissetabefarm.com/uploads/1/3/1/8/131872017/070e5ec.pdf
    • http://sarahc.online/uploads/1/3/0/8/130873944/9ddef92f110f96.pdf
    • http://advancecommodities.com/uploads/1/3/1/3/131379874/pekujilolunod-loxajulere-sazubori.pdf
    • http://mountaintherapygroup.com/uploads/1/3/1/6/131636700/rufubozufa.pdf
    • http://dakotaashleymarie.com/uploads/1/3/1/3/131380594/6487182.pdf
    • http://throgsneckmall.com/uploads/1/3/0/2/130271126/xizunev_gesakaxum_poterojused.pdf
    • http://brettreadwell.com/uploads/1/3/0/8/130874514/wotesijuponixemalo.pdf
    • http://1sttimebuyerdeposit.com/uploads/1/3/0/4/130475877/7912877.pdf
    • http://additionmeddevicetalentsolutions.com/uploads/1/3/0/2/130291499/4927673.pdf
    • http://lowcountryhouse.com/uploads/1/3/0/6/130621214/dipetebesewipevuvo.pdf
    • http://canineandequineranch.org/uploads/1/3/1/8/131857041/7474550.pdf
    • http://robsplaceatgoldenlake.com/uploads/1/3/0/6/130621214/6890555.pdf
    • http://questessentials.com/uploads/1/3/0/3/130313755/joxozobotinabup.pdf
    • http://tinmanlifecoaching.com/uploads/1/3/0/9/130969371/8c115da75f7.pdf
    • http://worthithouston.com/uploads/1/3/1/8/131871993/d1db36.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000f44e.bin
4e9498f7742c91c386b30a5d833f18f74466bee6cff11d9914db0e362dbcecd8		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF44E 32996 bytes
font_00_sfnt_off0000c894.bin
e30837a8a634054ef7d3d29779c48d2c0557924084ac3ff79152871da042dfe1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC894 2888 bytes
font_01_sfnt_off0000d481.bin
b223a815badc023de40c76a56fc2cb20ed07f9da79ff73ae7c1234962bc58aec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD481 9208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.