Malicious PDF — malware analysis report

Static analysis result for SHA-256 22dbbc8ea905e42d…

MALICIOUS

PDF

49.4 KB Created: 2020-03-20 03:09:40 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 40befc02c3b38716a2f98c58b6fd69a6 SHA-1: 3602a801d57cb1a1182c39250a15a90e31467cf4 SHA-256: 22dbbc8ea905e42d4b19d62e2ffc71c8f3319771133bccc031faec866d9d0b10
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text mentions 'Elaboracion de objetivos smart', which appears to be a lure. The primary IOC is the first external URI, http://whyagileteamsfail.com/uploads/1/3/0/5/130539016/130539016.html#elaboracion+de+objetivos+smart, which leads to a collection of other PDF files hosted on various domains. This suggests a link farm or redirection scheme designed to drive traffic or host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://whyagileteamsfail.com/uploads/1/3/0/5/130539016/130539016.html#elaboracion+de+objetivos+smart PDF link annotation
    • http://carolinetaylor.com.au/uploads/1/3/0/3/130313247/ef01b70da76bb.pdfIn PDF document text
    • http://productiveproductcreation.com/uploads/1/3/0/6/130639762/1078455.pdfIn PDF document text
    • http://www.mirikatzman.com/uploads/1/3/0/5/130589159/6731217.pdfIn PDF document text
    • http://stonemountaincoop.com/uploads/1/3/0/5/130551661/4093239.pdfIn PDF document text
    • http://nataliekasdan.com/uploads/1/3/0/3/130379172/1486622.pdfIn PDF document text
    • http://portsidecommunityartsfest.org/uploads/1/3/0/5/130588295/riwoj-kapemejexipujo-dumujefagufinem-soxepa.pdfIn PDF document text
    • http://sekolahberpikirindonesia.com/uploads/1/3/0/6/130620194/xolidulewolozub_wewakejabonisi_lolimiv.pdfIn PDF document text
    • http://track-tech.net/uploads/1/3/0/8/130813732/b3e4e0f2d0a63.pdfIn PDF document text
    • http://roundupgiving.org/uploads/1/3/0/4/130488584/6202493.pdfIn PDF document text
    • http://highclassgoods.shop/uploads/1/3/0/5/130539247/barerilam-sofizitow-fajinovo.pdfIn PDF document text
    • http://ifyousuffer.com/uploads/1/3/0/6/130604626/27a41a1363.pdfIn PDF document text
    • http://travelandtrendswithz.com/uploads/1/3/0/5/130550948/b254b7fb.pdfIn PDF document text
    • http://siesbajio.com/uploads/1/3/0/3/130323633/xudurigis.pdfIn PDF document text
    • http://www.streetacademics.com/uploads/1/3/0/2/130289542/tixufalazijanat-numujibijutow.pdfIn PDF document text
    • http://portraitprecision.com/uploads/1/3/0/7/130739462/jokudor-loxufifuwekin-nusadewixukoz.pdfIn PDF document text
    • http://quality1staluminum.com/uploads/1/3/0/6/130639030/49dfb178b499d.pdfIn PDF document text
    • http://bnnlegal.com/uploads/1/3/1/0/131071111/c70425321.pdfIn PDF document text
    • http://hostmaster.georesource.co.uk/uploads/1/3/1/0/131070590/putubite.pdfIn PDF document text
    • http://available38.unix1.com/uploads/1/3/0/7/130740537/3695615.pdfIn PDF document text
    • http://carolinedivine.com/uploads/1/3/0/8/130814909/8724238.pdfIn PDF document text
    • http://tieskeshop.club/uploads/1/3/0/5/130588656/57f4074ed48b1a6.pdfIn PDF document text
    • http://arpageddon.com/uploads/1/3/0/6/130639244/rabolewemiteke-gewizurugosex-kiruxilurarogo-bisekibuwibo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
🗂 Part of campaign: moovsterrelocation.com 4 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009418.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9418 9580 bytes
SHA-256: 4c38a8c5fd7553918199c71dd297a4e7656875ccc7e5e89263a12db1e29e9a92

Open this report in the interactive analyzer, or submit your own file for analysis.