Malicious PDF — malware analysis report

Static analysis result for SHA-256 1365b895163591df…

MALICIOUS

PDF

48.0 KB Created: 2020-03-25 03:12:58 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 2d000a5ccc9d9a12856c79b15b7a068a SHA-1: e5362f103cb4f1f10b7005f0ff4cb7c1ff37987e SHA-256: 1365b895163591df64c9726cbe1cbc461feb588cfc5adc64aa732961b494f440
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDF files on different domains, indicating a link farm. The primary URL found in the document body, http://buyorsellyours.com/uploads/1/3/0/5/130588943/130588943.html#programa+de+limpieza+y+desinfeccion+en+alimentos, is part of this pattern. This behavior is often used for SEO manipulation or to distribute malicious payloads, hence the high confidence in its malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://buyorsellyours.com/uploads/1/3/0/5/130588943/130588943.html#programa+de+limpieza+y+desinfeccion+en+alimentos PDF link annotation
    • http://falconinvestigates.com/uploads/1/3/0/8/130874395/bafavebemadosejetop.pdfIn PDF document text
    • http://southsideswish.com/uploads/1/3/0/6/130620859/4267b32.pdfIn PDF document text
    • http://iamjaredwhite.com/uploads/1/3/0/7/130738752/ae3e069085680.pdfIn PDF document text
    • http://blueraspberryscarves.com/uploads/1/3/0/6/130620371/840604a77c.pdfIn PDF document text
    • http://playingsuperhereos.com/uploads/1/3/0/7/130775292/kifebofojomelun-nadegebakonov-dalubirobure.pdfIn PDF document text
    • http://millerforcommissioner.org/uploads/1/3/0/4/130493037/6283802.pdfIn PDF document text
    • http://girlylocs.net/uploads/1/3/0/5/130539004/8836146.pdfIn PDF document text
    • http://goaldeputy.com/uploads/1/3/0/7/130739377/904ac44.pdfIn PDF document text
    • http://truvisionhealthnc.com/uploads/1/3/0/3/130313613/a99e43.pdfIn PDF document text
    • http://newenglandcanna.com/uploads/1/3/0/7/130775162/c66fa.pdfIn PDF document text
    • http://287ranchsupplyboutique.com/uploads/1/3/0/7/130776420/fdfed3364759371.pdfIn PDF document text
    • http://www.esclerotica.com/uploads/1/3/0/7/130738684/jedutulabumuzepiwob.pdfIn PDF document text
    • http://www.bobrumbleart.com/uploads/1/3/0/6/130621397/8257322.pdfIn PDF document text
    • http://www.beautyworks.co/uploads/1/3/0/4/130476538/mozuzesujap.pdfIn PDF document text
    • http://thomashavlik.com/uploads/1/3/0/8/130874246/587c472b2d9d969.pdfIn PDF document text
    • http://tasmantranscription.com/uploads/1/3/0/2/130291589/3687918.pdfIn PDF document text
    • http://analeiswim.com/uploads/1/3/1/0/131070207/ad904a69334b.pdfIn PDF document text
    • http://hazeldorefarms.com/uploads/1/3/0/6/130605515/4802241.pdfIn PDF document text
    • http://bnbcharleston.com/uploads/1/3/0/6/130603740/siranuxuvalozurobi.pdfIn PDF document text
    • http://cpanel.mccauleylyman.com/uploads/1/3/0/6/130605255/9334989.pdfIn PDF document text
    • http://mail.vegrevillealliance.org/uploads/1/3/0/4/130476468/povubisokad.pdfIn PDF document text
    • http://kasuillc.com/uploads/1/3/0/4/130483205/tekigikemobesusikudi.pdfIn PDF document text
    • http://74-123-76-146.mgwnet.com/uploads/1/3/0/5/130588606/kebofubotabufedem.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000084c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84C7 8224 bytes
SHA-256: 99b95229beddae06f507b953256b454b040a15001e4c1bfa4b2ccc782e124812
font_01_sfnt_off0000a2bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA2BC 4112 bytes
SHA-256: 78ffaaae48d01fb879ab8339076c14d750641de80160eb14430198008da9c7c5

Open this report in the interactive analyzer, or submit your own file for analysis.