Malicious PDF — malware analysis report

Static analysis result for SHA-256 186d673766c44972…

MALICIOUS

PDF

52.8 KB Created: 2020-03-24 22:22:14 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 2080d41a2814c3eca0881c00cba9de66 SHA-1: 4afa63016f222f72f8c17849a7a6a2ceece25d6c SHA-256: 186d673766c449726c0388436d67cb51e2bc693a85f64fbb4c6e9fa71786cbbe
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a link farm, containing numerous embedded URLs pointing to external PDF documents across various domains. The ML classifier strongly indicates maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a mass external link farm. While no scripts were directly extracted, the sheer volume of outbound links suggests an attempt to manipulate search engine results or distribute malicious payloads indirectly.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oralkami.com/uploads/1/3/0/9/130969179/130969179.html#enlace+covalente+polar+estructura
    • http://www.gluxdrip.shop/uploads/1/3/0/8/130873943/1515842.pdf
    • http://agentforwriters.com/uploads/1/3/0/4/130488362/c1b656.pdf
    • http://joseon.net/uploads/1/3/0/8/130874281/rutirulusa.pdf
    • http://voxelfabbing.com/uploads/1/3/0/2/130270823/jojosemavofotovoned.pdf
    • http://helpinghandsstars.com/uploads/1/3/0/5/130550879/3173af0649fa209.pdf
    • http://combatsportsdietitian.com/uploads/1/3/0/6/130639607/kigonuzoko.pdf
    • http://deviseagency.com/uploads/1/3/0/6/130621663/262520.pdf
    • http://mypyxy.com/uploads/1/3/0/3/130323141/45af0c95.pdf
    • http://commercialleasenegotiation.net/uploads/1/3/0/7/130776065/a3686c0a19.pdf
    • http://centerofhelleniceducation.com/uploads/1/3/0/5/130588822/6484677.pdf
    • http://bxandx.com/uploads/1/3/0/4/130489275/7683482.pdf
    • http://davidptarleton.com/uploads/1/3/0/2/130270974/wirodupa_benanovige_loruvu.pdf
    • http://dcchosa.com/uploads/1/3/0/3/130379146/bca77c6b5cb3.pdf
    • http://packerforcamphill.com/uploads/1/3/0/9/130970008/c7f5e1fe7b71.pdf
    • http://coffeewithfriends.ca/uploads/1/3/0/5/130589243/5295639.pdf
    • http://medicalsims.com/uploads/1/3/0/2/130272585/jugapujafi_xifabutalim_givejifuke.pdf
    • http://stumblinghouseholder.com/uploads/1/3/0/5/130589146/tolodul.pdf
    • http://rededemidias.net/uploads/1/3/0/4/130436007/5791cb0f5cfc.pdf
    • http://hostmaster.mini-crane.ca/uploads/1/3/1/1/131163507/b68e1.pdf
    • http://growincome.net/uploads/1/3/0/5/130539837/a50681c32e.pdf
    • http://veyve.org/uploads/1/3/0/4/130488580/biwosinipiwewikivi.pdf
    • http://justinalmquist.com/uploads/1/3/0/5/130589208/3255f2.pdf
    • http://melodycares.com/uploads/1/3/0/8/130813835/8009111.pdf
    • http://puzzledplate.com/uploads/1/3/0/7/130739764/katimizezurev.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000969e.bin
72ffd9f5409fd632a062e078c7b81edbcb6a4fac9ae5f4f7bd21b739620ae983		 pdf-font-stream PDF embedded font (sfnt) at offset 0x969E 9368 bytes
font_01_sfnt_off0000b8a9.bin
9eacf44dcfbd551285ab3554f8efeb9a1c4b31c24762b0bc917ea130b2a7dc8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB8A9 2988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.