Malicious PDF — malware analysis report

Static analysis result for SHA-256 2414f59056c8c455…

MALICIOUS

PDF

39.9 KB Created: 2020-03-12 10:16:16 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c857a6a42745f1f824513b45a1906e87 SHA-1: 57d260c9b021cc443ac90e87f109ef769d20beb1 SHA-256: 2414f59056c8c455c8f693ce5c57aa8b51a9c7bc0461d5e275ac8b18e0c045c0
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF documents hosted on different domains. The ML classifier also strongly indicated maliciousness. This suggests a tactic to drive traffic to a large collection of hosted content, potentially for SEO poisoning or to distribute further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jke.brdge.org/uploads/1/3/0/6/130604557/130604557.html#how+does+calcium+play+a+role+in+muscle+contraction
    • http://angelorayer.com/uploads/1/3/0/2/130288380/nimofis.pdf
    • http://voice-chati.com/uploads/1/3/0/6/130621362/2846655.pdf
    • http://mx.customgemcutter.com/uploads/1/3/0/4/130476146/pozonujadinewak_mabidavo.pdf
    • http://dreamsintosuccess.org/uploads/1/3/0/7/130740450/buzemebudoweb_jinazewizajel.pdf
    • http://finditwithease.com/uploads/1/3/0/2/130272945/moxekeloneba.pdf
    • http://successfulperception.com/uploads/1/3/0/7/130740590/mefebakuk.pdf
    • http://www.wakingwithjen.com/uploads/1/3/0/5/130551775/dosazakulegikit.pdf
    • http://www.bestlawncolorado.com/uploads/1/3/1/0/131071043/bivulonimesebim.pdf
    • http://kyaramichellephotography.com/uploads/1/3/0/5/130540208/109981f.pdf
    • http://www.dianaewingart.com/uploads/1/3/0/7/130776888/257fe00bdc6.pdf
    • http://gabrielkane.com/uploads/1/3/0/8/130813785/sijemulujumoko_simaxakagig_zukulude_revofopa.pdf
    • http://duplicationtribe.com/uploads/1/3/0/6/130639266/wajebegebuvonalobu.pdf
    • http://kenaleon.com/uploads/1/3/0/2/130291694/4f5cc2ca.pdf
    • http://webmail.urbancreativity.org/uploads/1/3/0/5/130590058/6087744.pdf
    • http://chuysmex.com/uploads/1/3/0/4/130483393/fexagojanutoz-dosogog.pdf
    • http://raysfinelinens.com/uploads/1/3/0/6/130605228/ropajaluma.pdf
    • http://marketdata-group.com/uploads/1/3/0/5/130539843/9450753.pdf
    • http://thesunshinetomatocompany.com/uploads/1/3/0/6/130620601/c69048c2ecbe2a8.pdf
    • http://albireovineyards.com/uploads/1/3/0/3/130323462/6175095.pdf
    • http://higherselfascendancy.com/uploads/1/3/0/7/130775014/nesofefolomemasa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072f5.bin
bb6e7d093632508dbda400f33b8580856bec5826f7a1fb6bc6e3a35df35a5c5a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72F5 8252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.