Malicious PDF — malware analysis report

Static analysis result for SHA-256 18228ebae39aa131…

MALICIOUS

PDF

38.5 KB Created: 2020-03-16 05:55:05 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ead14fd72b99f74eea12c982295a15c7 SHA-1: 49c89c32d1002f5e0d181ad8977c3554aefd1e70 SHA-256: 18228ebae39aa131961479c285dc79bb0a588a792323d3184209fdb0817b393b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, a technique commonly used in phishing campaigns to redirect users to malicious websites. The ML classifier strongly indicated maliciousness, and the PDF structure suggests a link farm designed to host or distribute further malicious content. No scripts were extracted, but the sheer volume of external links points to a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wcd-qe6b02fu.mgh-r.ch/uploads/1/3/0/5/130589219/130589219.html#butyl+rubber+sheet+nz
    • http://hostmaster.manchesterbusinessradio.co.uk/uploads/1/3/0/3/130313070/fewibonudaril.pdf
    • http://www.vetsmithbermuda.com/uploads/1/3/0/9/130969932/4463213.pdf
    • http://mpowerempire.com/uploads/1/3/0/6/130604806/xujamofezo-kazixofijura-firexapusuvozim-dajotulavegubo.pdf
    • http://juantaborda.com/uploads/1/3/0/4/130477719/lozenikufab-nitep.pdf
    • http://mrannounceit.com/uploads/1/3/0/7/130776075/2246782.pdf
    • http://mipropiotechoinmobiliariasas.com/uploads/1/3/0/3/130379251/zijulusosa-pajorododin-bezagulug-kowigufisa.pdf
    • http://lickatoad.com/uploads/1/3/0/3/130323199/7451209.pdf
    • http://cmcgill.com/uploads/1/3/0/5/130538956/33db13.pdf
    • http://485harrison402.com/uploads/1/3/0/3/130323937/rekepo_gebapiminegafej.pdf
    • http://byggsok-ost.no/uploads/1/3/0/7/130740128/wukop.pdf
    • http://momopets.co/uploads/1/3/0/2/130270768/7626850.pdf
    • http://cpanel.bizblog.hk/uploads/1/3/0/6/130621212/famoxufofafawe.pdf
    • http://tampalandscapedesign.com/uploads/1/3/0/6/130603874/xatomujigijej.pdf
    • http://biblesforchinaphotos.com/uploads/1/3/0/3/130323290/nujabuzawi.pdf
    • http://www.bodymindandsport.club/uploads/1/3/0/4/130476102/8404a2bcb.pdf
    • http://krdrecruitment.com/uploads/1/3/0/5/130588573/0eb0dbb95b639d.pdf
    • http://homeartscontentandcopywriting.com/uploads/1/3/0/7/130776157/wadepup.pdf
    • http://carterslearningcenter.com/uploads/1/3/0/2/130271211/fabanevepujebemolin.pdf
    • http://deafsignsandwonders.com/uploads/1/3/0/4/130488875/5589715.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d9b.bin
5b46333b6d890fae94b0064a59832b4fa6b50673af46b26f65bf9619ce5f3578
pdf-font-stream PDF embedded font (sfnt) at offset 0x6D9B 8096 bytes