Malicious PDF — malware analysis report

Static analysis result for SHA-256 27f076f42e9a1fae…

MALICIOUS

PDF

45.0 KB Created: 2020-04-02 21:20:35 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: e2d0b768a1b77712bb8fb2fa6db8ac8a SHA-1: b67d00964bcf96797b557d645c43e6a99279120a SHA-256: 27f076f42e9a1faec0079466185a76187979f80272d2e1e92ae627c7bf981e1e
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF document contains a lure related to 'Kindergarten sight words flash cards' but is primarily a link farm, with numerous external PDF links hosted on various domains. This suggests a Search Engine Optimization (SEO) manipulation tactic or a distribution method for further malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, and 'PDF_URI' points to one such link. No scripts were extracted, limiting the analysis of direct payload execution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://expensivepups.com/uploads/1/3/0/2/130272350/130272350.html#kindergarten+sight+words+flash+cards PDF link annotation
    • http://midloturf.org/uploads/1/3/0/8/130874587/3585e79c.pdfIn PDF document text
    • http://rayaneid.com/uploads/1/3/0/3/130313241/aea553216.pdfIn PDF document text
    • http://phoenixasiaconsultants.com/uploads/1/3/0/6/130621588/dilezuwokowodo.pdfIn PDF document text
    • http://tcronline.net/uploads/1/3/0/5/130544635/rebemat_siwanasumug_bipun_fojeruzalita.pdfIn PDF document text
    • http://speakta.me/uploads/1/3/0/6/130620202/8590511.pdfIn PDF document text
    • http://ryanbokehphotography.com/uploads/1/3/0/7/130775584/2952613.pdfIn PDF document text
    • http://aronkodeshesbydesign.com/uploads/1/3/0/6/130604764/9943742.pdfIn PDF document text
    • http://driven-promotions.com/uploads/1/3/0/2/130271185/momonigijibes_livitoxutuzo_mopatuputejuxi_vadajapeb.pdfIn PDF document text
    • http://sparcinnovations.net/uploads/1/3/0/2/130273803/ditoj_dixejudawenivev.pdfIn PDF document text
    • http://gemandiyoga.com/uploads/1/3/1/1/131164127/6d88a947ff.pdfIn PDF document text
    • http://mulherinfoundation.org/uploads/1/3/0/8/130874217/jurunubifej-getikari-fepusikixoxot.pdfIn PDF document text
    • http://brawlinfo.com/uploads/1/3/0/4/130476974/1982900.pdfIn PDF document text
    • http://bluehoneydew.com/uploads/1/3/0/5/130547624/lirej_xugow.pdfIn PDF document text
    • http://ardingtonschoolofcrafts.com/uploads/1/3/0/8/130874679/2ff1f.pdfIn PDF document text
    • http://goletacoffeeco.com/uploads/1/3/0/2/130273623/gupomigud-zijoxodi.pdfIn PDF document text
    • http://lapaperaartigiana.com/uploads/1/3/1/1/131163879/xagareraw.pdfIn PDF document text
    • http://derlungenarzt.com/uploads/1/3/0/7/130774999/1875822.pdfIn PDF document text
    • http://encouragingpositivecommunication.net/uploads/1/3/0/5/130588159/e96bb0ef0.pdfIn PDF document text
    • http://tanmayms.com/uploads/1/3/0/6/130620464/a4422.pdfIn PDF document text
    • http://lifewithpaul.com/uploads/1/3/0/2/130287813/1130395.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007d5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7D5D 8108 bytes
SHA-256: bd9d7efd62a6ff808edafeb62fa112bc6cc960ac60c74346dcef0d9842a1e06f
font_01_sfnt_off00009ca8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9CA8 2652 bytes
SHA-256: e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc

Open this report in the interactive analyzer, or submit your own file for analysis.