PDF malware analysis — malicious · 1fcf76757e5f2c9d

MALICIOUS

PDF

44.6 KB Created: 2020-04-04 15:54:27 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: d872c668e9e0482ad724126888bcb6b8 SHA-1: fc4340d038f111741988bd4b795ee367340ca510 SHA-256: 1fcf76757e5f2c9d061595cfb55e1ab94773c0ff6d2b9327ab256aa20ddb4818

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains embedded JavaScript and a large number of external links, indicating a malicious intent to redirect users to potentially harmful websites. The PDF_SEO_LINK_FARM heuristic firing suggests a deliberate attempt to create a link farm, likely for SEO manipulation or to host further malicious content. The ML classifier strongly supports the malicious verdict.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://essenerequipment.com/uploads/1/3/0/6/130621142/130621142.html#libro+el+cartel+negro+pdf
- http://jkconstructionremodelingllc.com/uploads/1/3/0/5/130588153/nixotareluwixaradot.pdf
- http://skinnyfatmat.com/uploads/1/3/0/2/130289166/rupoxexakadikidava.pdf
- http://campk-9doggiedaycamp.com/uploads/1/3/0/5/130551011/1aed19f050dfe.pdf
- http://contractlawtraining.com/uploads/1/3/0/8/130874629/ea7562d6197c.pdf
- http://allielynch.com/uploads/1/3/0/2/130271255/3282416.pdf
- http://raleighlaxfest.org/uploads/1/3/0/2/130289218/zolapulasu_minusurijomi.pdf
- http://orasplace.com/uploads/1/3/0/4/130489475/xulovi.pdf
- http://sweetiments.com/uploads/1/3/1/3/131380951/95dcf4a5.pdf
- http://freexboxlivepoint.com/uploads/1/3/1/3/131379759/kidopelonoze.pdf
- http://back2businessconsulting.com/uploads/1/3/0/4/130476586/737903.pdf
- http://monthlytoothtalk.net/uploads/1/3/0/5/130540037/f3038.pdf
- http://mx.championstorage.com/uploads/1/3/0/4/130435611/b9ba9da.pdf
- http://gaurdlifenow.com/uploads/1/3/0/9/130969774/vofikozezinutivaku.pdf
- http://dogncatdentistry.com/uploads/1/3/1/3/131379060/memawaz.pdf
- http://legendarytabletop.com/uploads/1/3/0/9/130969335/9c2fa68fc6332ae.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006d4d.bin` `903f913340a0fd60d113b29950411015719ac6ede21a3fc40320865bc9d58510`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6D4D	9156 bytes
`font_01_sfnt_off00008e88.bin` `bb65e153df78154bfd14470754e87ba03df7715f8d52849d071c5334056f3476`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8E88	16096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.