Malicious PDF — malware analysis report

Static analysis result for SHA-256 197e923a8a0bb82b…

MALICIOUS

PDF

41.6 KB Created: 2020-03-12 06:56:15 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4da8fc7942e7429dfbbb9b32816ea26f SHA-1: 027d4ba480f78fe60c3a068f6df4b9eac866df8f SHA-256: 197e923a8a0bb82b9f4583154e49f57dccffb9b2470e70ba7b7d14cc2d2e1b78
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1190 Exploit Public-Facing Application

This PDF document contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The primary URL, http://directroofrestoration.com/uploads/1/3/0/8/130814933/130814933.html#writing+activity+for+esl+students, and numerous others point to various domains, suggesting a campaign to manipulate search engine results or distribute malicious content through these linked pages. No scripts were extracted, but the sheer volume of outbound links is highly suspicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://directroofrestoration.com/uploads/1/3/0/8/130813428/130813428.html#writing+activity+for+esl+students
    • http://care-association.us/uploads/1/3/0/4/130435667/bd7036a3.pdf
    • http://afrocubanforum.org/uploads/1/3/0/7/130775529/gukan.pdf
    • http://www.richmondspringcleaning.com/uploads/1/3/0/6/130621854/e47dcc0d0b106.pdf
    • http://mfengshui.com/uploads/1/3/0/7/130739635/6156508.pdf
    • http://mylesgrp.com/uploads/1/3/0/6/130640123/cd9d40c35fba68.pdf
    • http://heathersfabulousfinds.com/uploads/1/3/0/7/130776103/rimowesawodoru_vusejoxovo.pdf
    • http://geeksmind.com/uploads/1/3/0/6/130603855/3702583.pdf
    • http://chooseyourfamilyadventures.com/uploads/1/3/0/6/130621362/b6c55ffdc.pdf
    • http://www.pulzephotography.co.uk/uploads/1/3/0/8/130814933/tatogekoxiril.pdf
    • http://chefssexybbq.com/uploads/1/3/0/2/130270931/bcea7e24f8b2533.pdf
    • http://texasstocklawyer.com/uploads/1/3/0/6/130604476/8452427.pdf
    • http://webdisk.ancientcitycustoms.com/uploads/1/3/0/5/130543059/4756081.pdf
    • http://koamartialarts.com/uploads/1/3/0/4/130436441/1654545.pdf
    • http://fourleafcloverhart.com/uploads/1/3/0/5/130539553/4638676.pdf
    • http://amanam.asia/uploads/1/3/0/4/130435774/faxiwawenumixa.pdf
    • http://bbcsalberta.com/uploads/1/3/0/6/130621409/ab95da20c6a9b11.pdf
    • http://www.hawkinsvillemercantile.online/uploads/1/3/0/7/130776889/nimumin.pdf
    • http://eastsidebrand.org/uploads/1/3/0/2/130287413/6484888.pdf
    • http://hostmaster.urbanati.com/uploads/1/3/0/6/130639681/sijutoj.pdf
    • http://mtpleasantpatriots.com/uploads/1/3/0/6/130621523/zubudaxagofegoj-wowut-kitixufi-loduk.pdf
    • http://auto-modz.com/uploads/1/3/0/2/130289748/96e21df0dc1d4.pdf
    • http://mjbjacobs.com/uploads/1/3/0/3/130379415/budupumelef.pdf
    • http://annamariecrowhurst.com/uploads/1/3/0/2/130289760/debunofujaba.pdf
    • http://www.headachesucks.com/uploads/1/3/0/7/130739240/a139c6d0.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000796d.bin
ca5fb1a1988cb35cbe28e3bf11966a4a331c26748547d5c4169bdd7757b7ef9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x796D 8036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.