Malicious PDF — malware analysis report

Static analysis result for SHA-256 327cf44aa5c8b5fe…

MALICIOUS

PDF

45.7 KB Created: 2020-04-01 12:23:50 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f136c4ed7e246f37dff2622930e8be86 SHA-1: 5f97431ab5b45f2a35c2add4eac77dbaf66eed5f SHA-256: 327cf44aa5c8b5fe4e2cd2a2fbc5b278052128f6f89f52fb68d2bfd615ddab91
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure for a 'Chessbase mega database 2015 free download', which is a common tactic for distributing pirated software or malware. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, likely to obscure the malicious destination and potentially for SEO manipulation. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious download lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northernrailleaders.com/uploads/1/3/0/6/130604708/130604708.html#chessbase+mega+database+2015+free+download
    • http://supriv.com/uploads/1/3/0/2/130289773/pedapenix.pdf
    • http://patronbarber.com/uploads/1/3/0/9/130969959/583394965b59b2.pdf
    • http://munromontalvo.org/uploads/1/3/1/3/131379117/jaxiwir.pdf
    • http://animalmuscle.com/uploads/1/3/0/7/130776341/cd845b852f7.pdf
    • http://datacenter.nttrdc.com/uploads/1/3/0/9/130969160/7335499.pdf
    • http://cohorsiustorum.org/uploads/1/3/0/4/130436482/deguwep.pdf
    • http://buchscan.ch/uploads/1/3/0/9/130969492/gizibekuxixeb.pdf
    • http://allisonericksen.com/uploads/1/3/0/6/130639074/lovurutepu.pdf
    • http://builder.djsk8.com/uploads/1/3/0/6/130620618/gusonozejozazopa.pdf
    • http://valepontelo.com/uploads/1/3/0/8/130814441/xogolozerojove-fozuri.pdf
    • http://ritateylor.com/uploads/1/3/0/6/130620551/a842283df3.pdf
    • http://shopatouchofsass.com/uploads/1/3/0/3/130323100/5958206.pdf
    • http://sydneynatural.com/uploads/1/3/0/5/130588225/8071603.pdf
    • http://londonpottersguild.org/uploads/1/3/0/6/130604276/7013473.pdf
    • http://laurenmichellepeterson.com/uploads/1/3/0/6/130620607/2f54c.pdf
    • http://rktttherapy.com/uploads/1/3/0/3/130323571/5241048.pdf
    • http://mentalhealthjourneyonline.com/uploads/1/3/1/1/131163693/mezemovimomawis-lutozilu-zovizog-vakovivizuj.pdf
    • http://premosoulsad.com/uploads/1/3/0/6/130620781/6024607.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007215.bin
0f4f0d98d17478def94cd1392b851910b746f73ad5156ccc2ba026d41430f686		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7215 8548 bytes
font_01_sfnt_off00009307.bin
75ad5726b260fca9c3b66ca94450239fbc156c1891091fcfcfab965e4b2051b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9307 16376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.