Malicious PDF — malware analysis report

Static analysis result for SHA-256 314509887540db8c…

MALICIOUS

PDF

50.0 KB Created: 2020-03-10 03:45:52 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: da887b29a762973dbb64130e1c7f4c16 SHA-1: 7eed8d312cd1d720d7c49bf456f6123a927b233e SHA-256: 314509887540db8cccde8f752201bddb5801ce397cb8e12e0977e2c757341c67
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves leveraging these numerous links, with `http://www.policetrailer.com/uploads/1/3/0/8/130813582/130813582.html#pre+op+diet+for+gastric+sleeve+pdf` being a notable example. The document body itself is largely unreadable, but the presence of URLs and the heuristic firings strongly suggest a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.policetrailer.com/uploads/1/3/0/8/130813582/130813582.html#pre+op+diet+for+gastric+sleeve+pdf
    • http://petersburgproject.com/uploads/1/3/0/2/130291689/1547549.pdf
    • http://nice-plombier.fr/uploads/1/3/0/2/130270740/c2f40eb9f.pdf
    • http://tanyareed.com/uploads/1/3/0/5/130540453/06422ac.pdf
    • http://wolvesofgrace.com/uploads/1/3/0/8/130874422/mawov.pdf
    • http://www.aussieacademia.com.au/uploads/1/3/0/5/130589004/tazexi-gizebanopo-xufujuwovakud.pdf
    • http://webdisk.inversioneszeusllc.com/uploads/1/3/0/2/130291556/2896787.pdf
    • http://gangstar.org/uploads/1/3/0/3/130323894/14172d85.pdf
    • http://merkabaone.com/uploads/1/3/0/5/130589268/lolujaveko-nokabu.pdf
    • http://challengeyourlegal.com/uploads/1/3/0/6/130603793/petaso.pdf
    • http://ucccm.com/uploads/1/3/0/2/130287229/sagopijog_putulofi.pdf
    • http://opticagency.com/uploads/1/3/0/3/130323522/sojufadab_lezofixamuziw_dizezeta.pdf
    • http://1minutebrush.com/uploads/1/3/0/7/130740069/wexiwa_fenozod_rezegikaw.pdf
    • http://www.cleanlaundryllc.com/uploads/1/3/0/7/130776072/pekudakapi_netadoneluzupef.pdf
    • http://cousinohs.com/uploads/1/3/0/6/130603809/rizekidedupatavota.pdf
    • http://myezpzpay.com/uploads/1/3/0/5/130543598/7511764.pdf
    • http://99high.com/uploads/1/3/0/6/130604627/6110990.pdf
    • http://www.ohbloop.nl/uploads/1/3/0/8/130873740/vekedizetudag_lixejifuzaga.pdf
    • http://goombalooza.com/uploads/1/3/0/8/130814063/7481134.pdf
    • http://theafricanbeercompany.com/uploads/1/3/0/6/130621298/bojufa.pdf
    • http://positiveeducationeurope.com/uploads/1/3/0/4/130476814/gaxixov.pdf
    • http://www.medbill1.com/uploads/1/3/0/8/130815097/9466580.pdf
    • http://elitecareactivelife.com/uploads/1/3/0/7/130775209/pumixutanir.pdf
    • http://www.a1abiliyempowerment.org/uploads/1/3/0/2/130270957/mapufa-penoxegemiv-kipemigiwugu-buleralifad.pdf
    • http://intelroom.net/uploads/1/3/0/2/130273626/7a57d25.pdf
    • http://tncoding.com/uploads/1/3/0/6/130621148/mopupinisifob-zaboletinitowo-konopijamasekok-mubur.pdf
    • http://intelroom.net/uploads/1/3/0/2/130273626/7a
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009a95.bin
30bf482ed17842ef6a855b58cd1600ae4201292a7683f89effa22c98c6403a61		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A95 8180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.