Malicious PDF — malware analysis report

Static analysis result for SHA-256 307fe54c1bb9aa5b…

MALICIOUS

PDF

40.8 KB Created: 2020-04-02 20:45:43 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: a35222f176d02e133524033322bdbf2d SHA-1: ed5c8936060d4036225e23befc0b25324b8cea87 SHA-256: 307fe54c1bb9aa5b897bbd7873845a4997b20b571b9f7c8d9363319f6339d76d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO poisoning or to distribute malicious payloads. The PDF_SEO_LINK_FARM heuristic firing confirms this behavior, indicating a mass of external PDF links were generated. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mountainfc.org/uploads/1/3/0/4/130490808/130490808.html#sector+7+david+wiesner PDF link annotation
    • http://rehomingpaws.com/uploads/1/3/0/4/130477882/74410d6115.pdfIn PDF document text
    • http://no-such-thing.org/uploads/1/3/0/4/130483331/xekituwesit.pdfIn PDF document text
    • http://thelightoftheworldchoir.net/uploads/1/3/1/3/131381605/fudutako.pdfIn PDF document text
    • http://adaptiveshootingsports.com/uploads/1/3/0/6/130620624/galisixasanofafu.pdfIn PDF document text
    • http://therealsheaqueen.com/uploads/1/3/0/9/130969329/dokofizex.pdfIn PDF document text
    • http://catsfirstspayclinic.com/uploads/1/3/0/6/130621457/dodejumekogaw-koniveves-nulabelakuf.pdfIn PDF document text
    • http://islandarkproject.org/uploads/1/3/0/9/130969283/8449643.pdfIn PDF document text
    • http://maryvilleguitarlessons.com/uploads/1/3/0/3/130324416/2a530ec145.pdfIn PDF document text
    • http://onceuponatimeprincessparty.net/uploads/1/3/0/8/130814631/lubidemonag.pdfIn PDF document text
    • http://uxhability.com/uploads/1/3/0/7/130776521/luzuganuk_rugisofaz_gevinem_giroriloduta.pdfIn PDF document text
    • http://acculturationofmormons.org/uploads/1/3/0/6/130605015/7a718.pdfIn PDF document text
    • http://thegermancharme.com/uploads/1/3/0/2/130287229/45530e692be00b.pdfIn PDF document text
    • http://karlek.kitchen/uploads/1/3/0/7/130738825/8e6ca37e3319599.pdfIn PDF document text
    • http://thedetermineddoula.com/uploads/1/3/0/4/130436078/1503383.pdfIn PDF document text
    • http://since1984.co/uploads/1/3/0/6/130639822/171fe1e6cb9.pdfIn PDF document text
    • http://maxwellbodyworks.net/uploads/1/3/0/7/130775897/tikujidek.pdfIn PDF document text
    • http://wedgelessform.com/uploads/1/3/0/2/130287493/ximatikisagu-fobexatuzikik-zokegimi-kovakomeb.pdfIn PDF document text
    • http://juliabostridge.com/uploads/1/3/0/4/130476632/756b76a.pdfIn PDF document text
    • http://lyonandtheladies.com/uploads/1/3/0/6/130620471/1683b50cc.pdfIn PDF document text
    • http://battlemountaingroup.com/uploads/1/3/0/5/130590399/vobebotulu.pdfIn PDF document text
    • http://lrjrhawks.org/uploads/1/3/0/3/130313671/mapewimalujigoberexe.pdfIn PDF document text
    • http://laterallogisticsolutions.com/uploads/1/3/0/8/130813965/vefoxorikimopotiridu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007720.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7720 7860 bytes
SHA-256: 7e826c298bc6f70ed5c95355dda73210a98cf6ca6740a722dd0037114b5deef6

Open this report in the interactive analyzer, or submit your own file for analysis.