Malicious PDF — malware analysis report

Static analysis result for SHA-256 24eae9fa72474582…

MALICIOUS

PDF

45.7 KB Created: 2020-05-15 10:51:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-09-24
MD5: 9416bde68248320969a19ea93f2a4c3b SHA-1: ceabe52bd0a1c439d50b487b81177ef6f5ca5d47 SHA-256: 24eae9fa724745822541810f69aa72c2177edec89d578e8e022820711071572c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a distribution mechanism for further malicious content. No scripts were extracted, and the document body is heavily obfuscated, making it difficult to determine a more specific attack pattern beyond link distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blackfilmcentre.org/uploads/1/3/0/6/130620431/130620431.html#vernier+caliper+pdf+gujarati PDF link annotation
    • http://portfolioinvestmentpty.org/uploads/1/3/1/3/131379541/494207.pdfIn PDF document text
    • http://stjohnsuccpalmerton.com/uploads/1/3/1/6/131606844/c88eca400.pdfIn PDF document text
    • http://mobile-notary-of-california.com/uploads/1/3/0/5/130588806/sigorexubuzarodo.pdfIn PDF document text
    • http://araaragot.com/uploads/1/3/0/2/130291555/8444952.pdfIn PDF document text
    • http://woctravelsociety.com/uploads/1/3/0/7/130739938/9427775.pdfIn PDF document text
    • http://borderlinesproject.com/uploads/1/3/0/5/130588989/lorutabupelore.pdfIn PDF document text
    • http://something-creative.ca/uploads/1/3/1/0/131071076/zaguxalojab.pdfIn PDF document text
    • http://vocoderstudio.com/uploads/1/3/1/0/131070226/3716146.pdfIn PDF document text
    • http://julepnjoy.com/uploads/1/3/0/2/130272095/b972b00b0f1d0.pdfIn PDF document text
    • http://davidrobertloblaw.com/uploads/1/3/0/5/130539412/dobovizimorat_xutukidu.pdfIn PDF document text
    • http://bigheart.dk/uploads/1/3/0/7/130738819/2661242.pdfIn PDF document text
    • http://tintanegrahtx.com/uploads/1/3/1/4/131438257/9327418.pdfIn PDF document text
    • http://jordanlee.online/uploads/1/3/0/4/130477039/xupatidusinizezi.pdfIn PDF document text
    • http://hotspringslimo.com/uploads/1/3/0/5/130546977/9372819.pdfIn PDF document text
    • http://nhanceapp.com/uploads/1/3/0/6/130621278/1c8f1c556dbf4fb.pdfIn PDF document text
    • http://korinneroggenbuck.com/uploads/1/3/0/9/130969673/6c9c808e.pdfIn PDF document text
    • http://washingtonstateasa.com/uploads/1/3/0/6/130604241/859a4012.pdfIn PDF document text
    • http://careercoaching.sydney/uploads/1/3/1/4/131452814/gepotig_xofarokidi_wopopabi_banajaku.pdfIn PDF document text
    • http://jbuniquegifts.com/uploads/1/3/0/4/130435925/9f7d366a944.pdfIn PDF document text
    • http://luvapy.org/uploads/1/3/0/6/130604820/xojejowavogi.pdfIn PDF document text
    • http://garyfink.com/uploads/1/3/0/5/130588710/2919431.pdfIn PDF document text
    • http://aphroditessecrets.com/uploads/1/3/0/2/130272278/meluv_xesaxosiwajomul_mibepidavuzam_timutusutojotok.pdfIn PDF document text
    • http://terredevanille.com/uploads/1/3/1/8/131872138/joguludu_gomubujufa_nuwadikadezotel_vujidojof.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000084fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84FB 11192 bytes
SHA-256: f18f1f8efd6db36dd69889b87593e62329c1971a45a12c82e66741d499672808

Open this report in the interactive analyzer, or submit your own file for analysis.