Malicious PDF — malware analysis report

Static analysis result for SHA-256 314509887540db8c…

MALICIOUS

PDF

50.0 KB Created: 2020-03-10 03:45:52 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: da887b29a762973dbb64130e1c7f4c16 SHA-1: 7eed8d312cd1d720d7c49bf456f6123a927b233e SHA-256: 314509887540db8cccde8f752201bddb5801ce397cb8e12e0977e2c757341c67
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves leveraging these numerous links, with `http://www.policetrailer.com/uploads/1/3/0/8/130813582/130813582.html#pre+op+diet+for+gastric+sleeve+pdf` being a notable example. The document body itself is largely unreadable, but the presence of URLs and the heuristic firings strongly suggest a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.policetrailer.com/uploads/1/3/0/8/130813582/130813582.html#pre+op+diet+for+gastric+sleeve+pdf PDF link annotation
    • http://petersburgproject.com/uploads/1/3/0/2/130291689/1547549.pdfIn PDF document text
    • http://nice-plombier.fr/uploads/1/3/0/2/130270740/c2f40eb9f.pdfIn PDF document text
    • http://tanyareed.com/uploads/1/3/0/5/130540453/06422ac.pdfIn PDF document text
    • http://wolvesofgrace.com/uploads/1/3/0/8/130874422/mawov.pdfIn PDF document text
    • http://www.aussieacademia.com.au/uploads/1/3/0/5/130589004/tazexi-gizebanopo-xufujuwovakud.pdfIn PDF document text
    • http://webdisk.inversioneszeusllc.com/uploads/1/3/0/2/130291556/2896787.pdfIn PDF document text
    • http://gangstar.org/uploads/1/3/0/3/130323894/14172d85.pdfIn PDF document text
    • http://merkabaone.com/uploads/1/3/0/5/130589268/lolujaveko-nokabu.pdfIn PDF document text
    • http://challengeyourlegal.com/uploads/1/3/0/6/130603793/petaso.pdfIn PDF document text
    • http://ucccm.com/uploads/1/3/0/2/130287229/sagopijog_putulofi.pdfIn PDF document text
    • http://opticagency.com/uploads/1/3/0/3/130323522/sojufadab_lezofixamuziw_dizezeta.pdfIn PDF document text
    • http://1minutebrush.com/uploads/1/3/0/7/130740069/wexiwa_fenozod_rezegikaw.pdfIn PDF document text
    • http://www.cleanlaundryllc.com/uploads/1/3/0/7/130776072/pekudakapi_netadoneluzupef.pdfIn PDF document text
    • http://cousinohs.com/uploads/1/3/0/6/130603809/rizekidedupatavota.pdfIn PDF document text
    • http://myezpzpay.com/uploads/1/3/0/5/130543598/7511764.pdfIn PDF document text
    • http://99high.com/uploads/1/3/0/6/130604627/6110990.pdfIn PDF document text
    • http://www.ohbloop.nl/uploads/1/3/0/8/130873740/vekedizetudag_lixejifuzaga.pdfIn PDF document text
    • http://goombalooza.com/uploads/1/3/0/8/130814063/7481134.pdfIn PDF document text
    • http://theafricanbeercompany.com/uploads/1/3/0/6/130621298/bojufa.pdfIn PDF document text
    • http://positiveeducationeurope.com/uploads/1/3/0/4/130476814/gaxixov.pdfIn PDF document text
    • http://www.medbill1.com/uploads/1/3/0/8/130815097/9466580.pdfIn PDF document text
    • http://elitecareactivelife.com/uploads/1/3/0/7/130775209/pumixutanir.pdfIn PDF document text
    • http://www.a1abiliyempowerment.org/uploads/1/3/0/2/130270957/mapufa-penoxegemiv-kipemigiwugu-buleralifad.pdfIn PDF document text
    • http://intelroom.net/uploads/1/3/0/2/130273626/7a57d25.pdfIn PDF document text
    • http://tncoding.com/uploads/1/3/0/6/130621148/mopupinisifob-zaboletinitowo-konopijamasekok-mubur.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009a95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9A95 8180 bytes
SHA-256: 30bf482ed17842ef6a855b58cd1600ae4201292a7683f89effa22c98c6403a61

Open this report in the interactive analyzer, or submit your own file for analysis.