Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d14f5d096dd98aa…

MALICIOUS

PDF

43.9 KB Created: 2020-03-28 03:13:27 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: bee31e412acf3e7f62e3cd41f1a61dc2 SHA-1: 468e7550778bf9cb16d0c704b349fbd28d371255 SHA-256: 2d14f5d096dd98aa087dba48bda8236559c46fa6f051d6a8785c07153c957062
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body contains Spanish text related to a restaurant project, which may serve as a lure. The primary function appears to be directing users to a network of linked PDFs, potentially for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://harrisonrappaport.com/uploads/1/3/0/6/130604257/130604257.html#proyecto+para+restaurante+bar PDF link annotation
    • http://danfitts.com/uploads/1/3/0/6/130620372/815ebdca1baa4b.pdfIn PDF document text
    • http://admin.doublefreethink.co.uk/uploads/1/3/0/3/130379298/gosapokofejos-nodanifabofuwe-marumisoduj.pdfIn PDF document text
    • http://baoxian2.co.za/uploads/1/3/0/3/130323762/simudipo-dixim-dojuki.pdfIn PDF document text
    • http://dunebeat.com/uploads/1/3/0/5/130588685/puduxoziduvevap.pdfIn PDF document text
    • http://rumblejewels.net/uploads/1/3/0/8/130874623/gakuvid-xuzatog-pokepa.pdfIn PDF document text
    • http://alaalohagirlsstate.org/uploads/1/3/0/7/130739542/deban_judafi_daxanitaxuz.pdfIn PDF document text
    • http://zenlilymusic.com/uploads/1/3/0/6/130604626/xanutudisuxu.pdfIn PDF document text
    • http://mx.kim-bella.com/uploads/1/3/0/7/130740297/8960613.pdfIn PDF document text
    • http://www.sunsetcafechicago.com/uploads/1/3/0/5/130588502/taxakasixegesob_lewixozasidaw_gokoliv_pepawori.pdfIn PDF document text
    • http://vaviyod.sites.logojoy.com/uploads/1/3/0/7/130775570/kitidavomuvonozudax.pdfIn PDF document text
    • http://www.lovelustboudoir.com/uploads/1/3/0/4/130435881/nuratop.pdfIn PDF document text
    • http://edushareasia.com/uploads/1/3/0/9/130969173/2366177.pdfIn PDF document text
    • http://www.jasonetonscott.com/uploads/1/3/0/5/130546538/kixisebi-tuponobimupa-vonube.pdfIn PDF document text
    • http://sweetarthilo.com/uploads/1/3/0/2/130288818/rotoroxef.pdfIn PDF document text
    • http://byjingo.biz/uploads/1/3/0/5/130588334/7273143.pdfIn PDF document text
    • http://freelanceombudsman.com/uploads/1/3/0/7/130776006/3e083f.pdfIn PDF document text
    • http://www.agoodtalker.com/uploads/1/3/0/6/130604256/tunitezuvix-ramezewosakek.pdfIn PDF document text
    • http://www.funkytownpedicab.com/uploads/1/3/0/6/130639875/bidetevedidelis.pdfIn PDF document text
    • http://mta-sts.mx.annualmuster.com/uploads/1/3/0/9/130969631/9864449.pdfIn PDF document text
    • http://fridaycastshow.com/uploads/1/3/0/7/130740199/2062121.pdfIn PDF document text
    • http://fastflowdrainplumbing.com/uploads/1/3/0/6/130621284/54791.pdfIn PDF document text
    • http://secretgourmetpicnic.com/uploads/1/3/0/6/130605174/2650577.pdfIn PDF document text
    • http://siyuanlipiano.com/uploads/1/3/0/4/130483632/nipitabosojejax_bedozikiso_roboke_wufojudulomu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007f79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F79 9084 bytes
SHA-256: c8e90f2368bb17cea2d653f45e31fa7eb1cc5be4640f41df6941bfbe236d4414

Open this report in the interactive analyzer, or submit your own file for analysis.