Malicious PDF — malware analysis report

Static analysis result for SHA-256 18b7b1fe386a0461…

MALICIOUS

PDF

40.8 KB Created: 2020-03-27 03:27:11 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 9932aab13ece7f40ae31ce0f9d43edac SHA-1: 83aa06fcf87486a41fa4de0fc88b9cc2e210ed97 SHA-256: 18b7b1fe386a046126358383ea643e4dcf070f062cf032155a6563698da762ad
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The embedded URL `http://ph-filter.com/uploads/1/3/0/6/130621210/130621210.html#madre+tierra+chayanne+coreografia+zumba` and numerous others point to potentially malicious content or phishing pages. The ML classifier strongly indicates maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ph-filter.com/uploads/1/3/0/6/130621210/130621210.html#madre+tierra+chayanne+coreografia+zumba PDF link annotation
    • http://freedomenergy-llc.com/uploads/1/3/0/7/130776141/nipoj.pdfIn PDF document text
    • http://cetefub.store/uploads/1/3/0/6/130621995/2312402.pdfIn PDF document text
    • http://mrsbyars.com/uploads/1/3/0/5/130550994/norokudikegutu_zeruse.pdfIn PDF document text
    • http://sales15-ip-phone.pleasingfood.com/uploads/1/3/0/8/130813756/1186a4f2.pdfIn PDF document text
    • http://michellerosa.org/uploads/1/3/0/4/130476086/jonakulo-fopesotu-dizaporav-nojuja.pdfIn PDF document text
    • http://dzineinterior.com/uploads/1/3/0/9/130969932/fetulin.pdfIn PDF document text
    • http://bg4c.com/uploads/1/3/0/2/130288361/galejirelu.pdfIn PDF document text
    • http://friendlyfork.com/uploads/1/3/0/5/130551611/mekor.pdfIn PDF document text
    • http://berndtcomicsandcollectibles.com/uploads/1/3/0/8/130813458/gateviluzokugu.pdfIn PDF document text
    • http://gisfornugget.com/uploads/1/3/0/3/130313113/dedabanel_vilewuma_geporube_kobusatalaweje.pdfIn PDF document text
    • http://thefunyips.com/uploads/1/3/0/5/130590658/nunajobagawogeviba.pdfIn PDF document text
    • http://lendamico.me/uploads/1/3/0/3/130324004/zonebujofisat.pdfIn PDF document text
    • http://www.kosmokayla.com/uploads/1/3/0/7/130739814/nowatin.pdfIn PDF document text
    • http://vetforpetnet.net/uploads/1/3/0/8/130874669/e7046dd9.pdfIn PDF document text
    • http://samplesite100.info/uploads/1/3/0/6/130621113/kosut_fukitowawaki_rizitamovux_gabenisowirepur.pdfIn PDF document text
    • http://dollhouseporcelain.com/uploads/1/3/0/8/130813630/3104631.pdfIn PDF document text
    • http://ntoumei.com/uploads/1/3/0/5/130545581/maxikudexesunadomi.pdfIn PDF document text
    • http://goldenbeachcafe.com/uploads/1/3/0/4/130476129/4e6bf.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005db5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5DB5 9140 bytes
SHA-256: d4c62944976c763be17d8e8464a759af2f3b307bd1ac7137206ff0c02b4353e0
font_01_sfnt_off00007ea3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7EA3 16092 bytes
SHA-256: c6c28444bcd94379862b6cc7f8cfcdbcdaeb026857ccdb099d87626a561054a6

Open this report in the interactive analyzer, or submit your own file for analysis.