Malicious PDF — malware analysis report

Static analysis result for SHA-256 1daf0a99d12d354f…

MALICIOUS

PDF

64.6 KB Created: 2020-06-19 15:41:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d12a62552bcbe30d4042c1946b24b781 SHA-1: 9b2a2efd9c44a117336cae8773690cf5bd9eedff SHA-256: 1daf0a99d12d354fb39115a31506d8b6ee1fb917d774fd1507d795f2eb5f9abb
94 Risk Score

Malware Insights

MITRE ATT&CK
T1598 Gather Victim Identity Information T1204 User Execution

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly indicated maliciousness. The document body is heavily obfuscated but contains a URL that is also listed in the extracted URLs. This suggests the primary purpose is to redirect users to a network of potentially malicious or SEO-manipulated websites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bestrealestateagentinbatonrouge.com/uploads/1/3/2/7/132741099/132741099.html#hussain+bin+mansoor+hallaj+urdu+pdf
    • http://jonahandsophiebnaimitzvah.com/uploads/1/3/0/7/130776374/topowama-lilizobefopolat-lawerefixixij.pdf
    • http://burnoutgrowth.com/uploads/1/3/0/6/130605002/fajebipopekatas.pdf
    • http://paids.info/uploads/1/3/0/5/130547340/tupuzezadu.pdf
    • http://aerialcanvas.online/uploads/1/3/0/6/130621300/5878833.pdf
    • http://greylockband.com/uploads/1/3/1/4/131408666/3416971.pdf
    • http://hydrolactic.com/uploads/1/3/0/9/130969310/8765757.pdf
    • http://wrebs.com/uploads/1/3/0/5/130542922/8774498.pdf
    • http://madminds.org/uploads/1/3/1/6/131606055/pimolawapid.pdf
    • http://arenius.systems/uploads/1/3/1/4/131438761/zobalivakir-fobukegowofo.pdf
    • http://hokitikarugbyleague.com/uploads/1/3/1/4/131453527/domovagul_jojisugit_jodamape.pdf
    • http://hostmaster.cravenvale.org.uk/uploads/1/3/0/9/130969235/c607685ecc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000d013.bin
201105f070aa74bc89a8fca150b1b2dc89b28ed18d24078b41ba856e3c8da369		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD013 22132 bytes
font_00_sfnt_off000094dd.bin
f0fa1264d811121bf0e307f2092ec3784519b02f01cfd6d81fc8c15e5bc4b342		 pdf-font-stream PDF embedded font (sfnt) at offset 0x94DD 5144 bytes
font_01_sfnt_off0000a609.bin
3db761b6176fd6cf98c8d14f932ce410fa65e6e1d8138829d554f5b215502dab		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA609 13732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.