PDF malware analysis — malicious · 34d324f1486dd406

MALICIOUS

PDF

42.8 KB Created: 2020-03-07 22:04:41 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: e87d6b8efae3096f9cb378b6575f96ba SHA-1: b7de9c1527b6640bae2baab4784e20f6a0933c0f SHA-256: 34d324f1486dd40660eedac2a4a558bc9df542fcb3b9e4f4cd888d47a6024e76

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a URL that matches one of the extracted links. The primary function appears to be directing users to a network of linked PDF documents hosted on various domains, likely for SEO spam or to distribute further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://chattpack.com/uploads/1/3/0/6/130621844/130621844.html#how+to+render+z+depth+in+3ds+max+vray
- http://juliebleahy.com/uploads/1/3/0/6/130639404/pikesogu.pdf
- http://profesionallashes.com/uploads/1/3/0/2/130270963/5152365.pdf
- http://snyderagencytx.com/uploads/1/3/0/2/130289218/kojevobetepaf.pdf
- http://indienavi.net/uploads/1/3/0/6/130639780/3262457932.pdf
- http://www.poiesiscounseling.com/uploads/1/3/0/7/130776275/a3fb05b7cfdbe.pdf
- http://northerndriveschool.com/uploads/1/3/0/5/130588363/2608885.pdf
- http://kathrynluster.net/uploads/1/3/0/5/130588757/bobure-bujakemuxanav.pdf
- http://mcleodcivil.com.au/uploads/1/3/0/7/130776222/9273163.pdf
- http://digidef.com/uploads/1/3/0/4/130435982/7784223.pdf
- http://bestflooringco.com/uploads/1/3/0/7/130776529/labirewuzajivemagad.pdf
- http://poledancepuertorico.com/uploads/1/3/0/8/130873962/mopuze_zidodebi_dulela.pdf
- http://dancinggoatsanctuary.com/uploads/1/3/0/7/130740180/rawutegu.pdf
- http://chengsin-caf.com/uploads/1/3/0/6/130620293/4485424.pdf
- http://www.bradjroberts.com/uploads/1/3/0/4/130483210/7180524.pdf
- http://kevinskids.org/uploads/1/3/0/4/130488196/6555972.pdf
- http://alohapossolutions.com/uploads/1/3/0/7/130776457/9397049e3d6.pdf
- http://metcalfe4pa.org/uploads/1/3/0/6/130604733/7367464.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006add.bin` `f73e7b639b888df63c51ccdf77dee954366338373cb39f2c37619c8821f4154f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6ADD	8480 bytes
`font_01_sfnt_off00008a99.bin` `afd8868629b61d85ec32a8a0de1ca84da82d48156cdd7447d7c4f51403cf5149`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A99	5244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.