Malicious PDF — malware analysis report

Static analysis result for SHA-256 380fca4cbe245cff…

MALICIOUS

PDF

37.8 KB Created: 2020-03-22 07:32:46 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: aaf0cdebdc91feb87b5f6c4e743620a0 SHA-1: 00f404f2ef7b3a6d5791efcbd20290eff446e72a SHA-256: 380fca4cbe245cfff70ef4bee661e22d0dd1e4a9f99cfb9cb2e419b39c7ae80d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains numerous links to external PDF files, a technique often used for SEO poisoning or to host malicious content. The document body mentions a 'Samsung se-506bb/tsbd firmware update', suggesting a lure to trick users into downloading potentially malicious firmware. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rapidrinsempw.com/uploads/1/3/0/5/130541004/130541004.html#samsung+se-506bb%2Ftsbd+firmware+update PDF link annotation
    • http://cafformation.com/uploads/1/3/0/6/130603753/328949a.pdfIn PDF document text
    • http://abullfrogstudio.com/uploads/1/3/0/5/130543106/654997.pdfIn PDF document text
    • http://egydairy.com/uploads/1/3/0/4/130435895/05f1401.pdfIn PDF document text
    • http://alniyatbellydance.com/uploads/1/3/0/4/130483184/2166512.pdfIn PDF document text
    • http://smartbuytrader.com/uploads/1/3/0/6/130604168/7298259.pdfIn PDF document text
    • http://csgocave.net/uploads/1/3/0/2/130288864/soxefalegizepop_kegizirekumuto_rilokeg_nejuga.pdfIn PDF document text
    • http://randyslounge.com/uploads/1/3/0/4/130435503/konixap_tivar_nabesuz.pdfIn PDF document text
    • http://insurancewebsitedesign.net/uploads/1/3/0/5/130590682/1896521.pdfIn PDF document text
    • http://thestrategicbutterfly.com/uploads/1/3/0/6/130621075/575690fe5c28de.pdfIn PDF document text
    • http://www.aleisyaaz.com/uploads/1/3/0/9/130969899/6339a7a9.pdfIn PDF document text
    • http://ladyboner.net/uploads/1/3/0/5/130550949/baf43f.pdfIn PDF document text
    • http://danscentrumnorr.com/uploads/1/3/0/2/130287988/52ab915c06.pdfIn PDF document text
    • http://friendlyschoolcounselor.com/uploads/1/3/0/3/130379101/17f3a.pdfIn PDF document text
    • http://www.warandpeacebuilding.com/uploads/1/3/0/5/130545382/2921817.pdfIn PDF document text
    • http://mail.secrethillband.com/uploads/1/3/0/6/130620594/bd71076.pdfIn PDF document text
    • http://distribuidoramario.net/uploads/1/3/0/4/130436513/ac572e2540.pdfIn PDF document text
    • http://www.projectrohingya.com/uploads/1/3/0/3/130312950/f58249b579a42.pdfIn PDF document text
    • http://thaitogether.org/uploads/1/3/0/7/130739891/3440097.pdfIn PDF document text
    • http://sirsandboys.net/uploads/1/3/0/7/130740610/cbc332978c5f.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
🗂 Part of campaign: ladyboner.net 3 samples

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C07 7596 bytes
SHA-256: 8682a4a1595dae4bb51b8b9199b4cb2e1c23b2d2102269e6efa13a8c81c48b84

Open this report in the interactive analyzer, or submit your own file for analysis.