Malicious PDF — malware analysis report

Static analysis result for SHA-256 270be1427ed6b2ab…

MALICIOUS

PDF

32.9 KB Created: 2020-03-23 13:26:05 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1cd5324f4a1a79e7e3b2520afa0650bc SHA-1: 902ffdeda2e9b1de9a0249be9d014e6f9f5ae9bb SHA-256: 270be1427ed6b2ab42e7741ba5ffd774871a08ecadcd5b0f3d10db924375273c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO spam or to redirect users to malicious sites. The ML classifier strongly indicated maliciousness. The document body contains text related to a movie title and authoring application details, but the primary malicious activity appears to be the extensive link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://three-ps-in-a-pod.com/uploads/1/3/1/1/131164128/131164128.html#la+caba%C3%B1a+pel%C3%ADcula%27completa%27en%27espa%C3%B1ol%27latino+2016
    • http://walleywag.com/uploads/1/3/0/6/130639607/gilug-luvegasulopiso-bupebedu-finemagofate.pdf
    • http://nylenken.com/uploads/1/3/0/7/130776219/2205b7b1f.pdf
    • http://9f60dmh005.com/uploads/1/3/0/4/130436365/4ccf2.pdf
    • http://marinbasic.com/uploads/1/3/0/4/130483402/botujalowebun.pdf
    • http://borderfinancial.com/uploads/1/3/0/8/130874629/d5a78.pdf
    • http://www.mywebsitellc.com/uploads/1/3/0/5/130540604/1a1913b.pdf
    • http://maximscotti.com/uploads/1/3/0/3/130313427/poxesukunejima_dinedape_mifado_pebipibapegigu.pdf
    • http://dreamscopeconsulting.com/uploads/1/3/0/3/130323384/5c84d65da563de.pdf
    • http://humanswhy.com/uploads/1/3/0/6/130639373/11b40d562.pdf
    • http://leoconstruction.org/uploads/1/3/0/5/130550846/wimoxu-munalabapuwaxa-nusan-zenobasuje.pdf
    • http://www.onestepcloser.blog/uploads/1/3/0/5/130539756/xewuwana-jatujikiweviwij-vefavo.pdf
    • http://www.pinataparty.club/uploads/1/3/0/7/130738537/nilonabupegutat-voguzinebakajaw-ravujedux.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005707.bin
218b7b2a3f44ef89beb7f0f563958d6f09a0a6ba23ed5a2dd87f90d734824017		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5707 7664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.