Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c3c871a09a70b3e…

MALICIOUS

PDF

43.2 KB Created: 2020-03-27 10:09:31 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1d52e6bfed11e5d0bf47b87a8fc0352a SHA-1: 345db4094df4055530474b805ca81ca384298e6c SHA-256: 1c3c871a09a70b3e0ba182427839285246353efdd73a587d2ada59f3a1843e7a
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document exhibits characteristics of a link farm, with a high number of external URLs embedded within it. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous links to potentially compromised or malicious domains suggests an attempt to redirect users to harmful content. The document body contains metadata and what appears to be garbled text, but the primary malicious activity is indicated by the extensive link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hapaintingdecorating.com/uploads/1/3/0/8/130814416/130814416.html#the+covenant+james+michener+ebook
    • http://traffics.site/uploads/1/3/0/7/130775918/ff258cc42bdfdb.pdf
    • http://burlesontrash.com/uploads/1/3/0/7/130738727/bamezuli.pdf
    • http://11.bpmtc.com/uploads/1/3/0/7/130740130/betaponi_sawanositadasi.pdf
    • http://goodchiroaz.com/uploads/1/3/0/9/130969854/zalefagubufe_najapof_relikujiwan_tofufibaxuwosak.pdf
    • http://eaclubs.net/uploads/1/3/0/2/130274076/9255355.pdf
    • http://www.conselheira-beleza.com/uploads/1/3/0/4/130435898/5849426.pdf
    • http://www.roryward.roryvincent.com/uploads/1/3/0/6/130621481/9958855.pdf
    • http://mirandaheath.com/uploads/1/3/0/7/130776886/polakapalajaviw_toxujazu.pdf
    • http://aetherglow.com/uploads/1/3/0/8/130813032/sesujubiput.pdf
    • http://hirebaton.com/uploads/1/3/0/6/130604675/1095882.pdf
    • http://5thousandcleaningservices.ca/uploads/1/3/0/4/130435680/motigujorav.pdf
    • http://srguniversity.com/uploads/1/3/0/3/130313107/mububi-wazer.pdf
    • http://mamalainesweets.com/uploads/1/3/0/8/130813782/2af445a27bf.pdf
    • http://www.maddelleinegrae.com/uploads/1/3/1/0/131070718/87d453ea24f4910.pdf
    • http://premiumfinancingllc.com/uploads/1/3/0/8/130813616/26c85c57b1e7b19.pdf
    • http://www.atlantacenterforhypnotherapy.com/uploads/1/3/0/4/130488934/zezin_lovefunabusuke.pdf
    • http://kazlwebmarketing.com/uploads/1/3/0/8/130873965/4211381.pdf
    • http://eastexvet.preview.pethealthnetworkpro.com/uploads/1/3/0/6/130604556/6665770.pdf
    • http://mommalovesyou.net/uploads/1/3/0/2/130272903/2673946.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008140.bin
afb6164344742accc8f7823128bba1c0b4034bc207e2b98dacfd97a6be85c5c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8140 7908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.