Malicious PDF — malware analysis report

Static analysis result for SHA-256 249e7675a243dc0a…

MALICIOUS

PDF

39.0 KB Created: 2020-03-30 13:58:23 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1aeb8499ca43fffa8b2dd847708b089b SHA-1: 3b79bfa93b90c7154625c9e924b7b34249db7dc0 SHA-256: 249e7675a243dc0a59a5b6b89d2e6f30bab757a932c9f12c5e039a8afac482cf
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links to other PDF documents hosted on various domains. This behavior is characteristic of a link farm, often used for SEO manipulation or to distribute malicious payloads. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of numerous external links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cfthomas.com/uploads/1/3/0/4/130483858/130483858.html#elaboracion+de+proyectos+sociales+gloria+perez+serrano+pdf
    • http://krisharty.com/uploads/1/3/0/4/130483986/7298259.pdf
    • http://kcrme.com/uploads/1/3/0/4/130476083/zesasosatixofomebu.pdf
    • http://ellensburgcanyonwinery.net/uploads/1/3/0/7/130739000/91b8d484af93b.pdf
    • http://movementmode.com/uploads/1/3/0/6/130639734/mujew.pdf
    • http://superproductionchallenge.ca/uploads/1/3/0/7/130739783/ab168d2d2.pdf
    • http://ccsps.info/uploads/1/3/0/6/130620618/wuwem.pdf
    • http://creativekin.ca/uploads/1/3/1/3/131383959/4432697.pdf
    • http://theshatteredcanvas.net/uploads/1/3/0/7/130775866/dagabirinerewu-zanomunepod-topenokewub.pdf
    • http://suziecutescafe.com/uploads/1/3/0/5/130538880/jiludotin.pdf
    • http://mawg.design/uploads/1/3/0/8/130813054/c0a00c71.pdf
    • http://clemsonumc.net/uploads/1/3/0/7/130738912/fazuwimobokodu-gapez-vokiruxa-xasaki.pdf
    • http://koncgroup.com/uploads/1/3/0/6/130640132/3233c3b852db1.pdf
    • http://taraannejohnson.com/uploads/1/3/0/9/130969580/zesegajikudisuxu.pdf
    • http://jayagana.com/uploads/1/3/0/6/130605175/zegibekipusuvisax.pdf
    • http://scougall.com/uploads/1/3/0/8/130874114/2990888.pdf
    • http://creativeofficesf.com/uploads/1/3/0/5/130543764/liladuri_pibadosurod_kugigasoxunufis_zojarimumumoli.pdf
    • http://tturbanranch.com/uploads/1/3/0/5/130589032/6844750.pdf
    • http://flea.floridapaints.com/uploads/1/3/1/4/131454932/5600581.pdf
    • http://drjordanbell.com/uploads/1/3/0/5/130551772/5209866.pdf
    • http://aibsuisse.ch/uploads/1/3/0/9/130970015/xolikedufixe.pdf
    • http://bridgewayidsolutions.com/uploads/1/3/0/6/130621206/kenefomi-tiruxofate-fekowije-jefikagebebir.pdf
    • http://karenfeiling.com/uploads/1/3/0/7/130740351/344928.pdf
    • http://41harleystreet.com/uploads/1/3/0/5/130543837/vulim-giwupo-zeponaguwefev-wenipunidedowib.pdf
    • http://waldemarbastos.net/uploads/1/3/0/6/130621954/wuvifegolizuzuto.pdf
    • http://cleckleroutdoors.com/uploads/1/3/0/6/130621874/walejopopuvadot.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d11.bin
56fa51fbab98c7f9ed86e2cda5943ed1f32e718241a7bba50462453660d68acc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D11 8256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.