Malicious PDF — malware analysis report

Static analysis result for SHA-256 36a7d5af832f6a41…

MALICIOUS

PDF

44.4 KB Created: 2020-04-01 15:45:26 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 34619ae208bf33c5a85b848a8e3dcc8c SHA-1: ef690009085ba549e2793753ba7344ead740db16 SHA-256: 36a7d5af832f6a417ce20d84d2c8061a48f0ee0e31d4d0faff028a0e875831fb
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to various domains, indicating a link farm or SEO manipulation tactic. The ML classifier strongly flagged this PDF as malicious. The primary attack pattern involves directing users to a network of seemingly unrelated websites, likely to distribute further malware or engage in phishing. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kellykeegs.com/uploads/1/3/0/6/130621135/130621135.html#what+does+patriotism+mean+to+you+essay
    • http://pollyshulman.net/uploads/1/3/0/6/130604692/8409154.pdf
    • http://powdercoatingcreations.com/uploads/1/3/0/6/130620612/008077a.pdf
    • http://galenmolk.com/uploads/1/3/0/2/130274301/xixuwikuvuxomi.pdf
    • http://vivavocestyling.com/uploads/1/3/0/2/130271205/ae58d3328504c.pdf
    • http://gobluesight.com/uploads/1/3/0/2/130288378/3378410.pdf
    • http://executivepetresort.com/uploads/1/3/0/6/130604188/rizumujiw-sajubosamin-begakutawuted.pdf
    • http://benjamin-hunt.com/uploads/1/3/0/6/130620606/8082315.pdf
    • http://criticalisthmus.com/uploads/1/3/0/8/130873864/kotavu.pdf
    • http://rpptl.com/uploads/1/3/0/5/130589287/sozofip.pdf
    • http://neilducrosphotography.com/uploads/1/3/0/6/130621313/2066322.pdf
    • http://oriontrainingsystems.org/uploads/1/3/0/6/130639842/390a5c36d.pdf
    • http://cascinabellavista.com/uploads/1/3/0/5/130545096/butinegabev.pdf
    • http://blue-skyservices.com/uploads/1/3/0/5/130551461/tafoka-donokaxobamatep.pdf
    • http://adifgo.com/uploads/1/3/0/5/130590412/8463392.pdf
    • http://carsonvalleycommunityfoodcloset.org/uploads/1/3/0/7/130740624/segepa_zusufava_fusujatotasin.pdf
    • http://shuckincrewsensationstraining.com/uploads/1/3/0/5/130590142/riwitax-muvoxasumipemo.pdf
    • http://ramsaydesigns.co/uploads/1/3/0/6/130620885/63042a23e.pdf
    • http://dawnwolfe.com/uploads/1/3/0/9/130969160/2622035.pdf
    • http://birthdoulaboston.com/uploads/1/3/0/3/130379743/giforimeban_tuwew_zizutadogiwido.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000070bc.bin
8578d1bb46b0780e53a7a1d0538139e73746913699646512a02d5877d70dc76a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70BC 7820 bytes
font_01_sfnt_off00008f38.bin
e1732afad814c741dd98b6db6bc7a41bee7146efcf81fc7fd6ccabd2c9be947e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F38 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.