Malicious PDF — malware analysis report

Static analysis result for SHA-256 28753a1d33ad0b5c…

MALICIOUS

PDF

49.3 KB Created: 2020-03-09 01:03:21 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: d4c4bd139369f2621029cd347987fba6 SHA-1: d99336fb15d034a6870d891229af3f72a8454695 SHA-256: 28753a1d33ad0b5c0b8535073bbb48396ba4443279e7ff2b33af76478a06c4d9
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by an ML classifier with high confidence. It contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The primary URL identified is http://www.hand-made-costume.com/uploads/1/3/0/5/130540926/130540926.html#lizzo+small+purse, and numerous other links to domains like analogelectronicsmt.com were also extracted. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.hand-made-costume.com/uploads/1/3/0/5/130540926/130540926.html#lizzo+small+purse
    • http://analogelectronicsmt.com/uploads/1/3/0/6/130621798/rodijuratoz.pdf
    • http://mix-moment.com/uploads/1/3/0/5/130552084/desuviwivugupuj.pdf
    • http://emekberaka.com/uploads/1/3/0/5/130588876/8fe33d99.pdf
    • http://griffelbok.com/uploads/1/3/0/6/130620585/saxalarebor-wozapedudepoxe-wevulad-nabogitejaz.pdf
    • http://sistim.biz/uploads/1/3/0/5/130539022/1729335.pdf
    • http://leggingwholesale.com/uploads/1/3/0/6/130621206/bopazajado_zutawaru.pdf
    • http://justmybooks.com/uploads/1/3/0/4/130483980/larifumapive_talav_budofinodasub_jibepe.pdf
    • http://gailwrites.com/uploads/1/3/0/6/130620970/wuzasizesufedoj.pdf
    • http://www.natashawheinz.com/uploads/1/3/0/3/130323141/452bb.pdf
    • http://mauicustomtour.com/uploads/1/3/0/8/130813956/35fd55244fe6.pdf
    • http://www.gohomeoffical.com/uploads/1/3/0/6/130604527/539251.pdf
    • http://iohannespontes.com/uploads/1/3/0/7/130775085/4b7a004.pdf
    • http://mytgob.com/uploads/1/3/0/5/130539113/2814083.pdf
    • http://turkeyvilla.info/uploads/1/3/0/6/130621361/tepekivelirabafibopi.pdf
    • http://theorderoftheoak.org/uploads/1/3/0/2/130272355/betivegalapupa-lisep-kafuz-zopotedoxa.pdf
    • http://rogerofmidgard.com/uploads/1/3/0/2/130288310/bebifopobonu_zukefa_nifonolekaj.pdf
    • http://alphaomegaimf.com/uploads/1/3/0/6/130639061/tubitesebawofobe.pdf
    • http://restorechurchnc.net/uploads/1/3/0/4/130476276/3112784.pdf
    • http://partridgeberryfestival.org/uploads/1/3/0/5/130550833/fc29ebea0aaf.pdf
    • http://www.sovonconsultingsvc.com/uploads/1/3/0/6/130604046/7902594.pdf
    • http://mosquesjobs.com/uploads/1/3/0/5/130588445/jexatoxeki.pdf
    • http://constellationentertainment.com/uploads/1/3/0/6/130620637/5411210.pdf
    • http://sarahsegesdy.com/uploads/1/3/0/5/130550664/09915ce7.pdf
    • http://saddlemachine.com/uploads/1/3/0/5/130539129/nimakadonutivele.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009476.bin
8d7ad44759cbe8806aef71eaba201dbae11ef553e5bb31416436879fc924ac82		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9476 9312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.