Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b1e624d5c855d69…

MALICIOUS

PDF

82.4 KB Created: 2020-03-13 18:06:26 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: d9380803bb76475cd963023fef7adcee SHA-1: 6251773b61d73c9b3e1545f6e081bf44fb9f4e2d SHA-256: 3b1e624d5c855d69df511b4583b70484c280b9a3778917ca88167c868803d6a1
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous external links, many of which point to SEO-optimized PDF files hosted on various domains. The document body, though partially corrupted, includes a URL that appears to be part of this link farm. This suggests a tactic to manipulate search engine results or drive traffic to a network of potentially malicious or spammy sites. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://a1542490xstreamtravel.xsideas.com/uploads/1/3/0/2/130287920/130287920.html#learning+english+voa
    • http://jordansullivanpr.com/uploads/1/3/0/6/130639138/zikunezijumareb.pdf
    • http://virginia-dunn.com/uploads/1/3/0/6/130639336/kunekinoxe.pdf
    • http://boomfastgroup.com/uploads/1/3/0/7/130740127/zetomogaxera.pdf
    • http://www.princesskustomz.com/uploads/1/3/0/5/130551696/23b88b48.pdf
    • http://catchmydrift.shop/uploads/1/3/0/3/130313173/neredu-xekules-fibavedev-vufamivok.pdf
    • http://landafooddistrib.net/uploads/1/3/0/2/130288811/5720704.pdf
    • http://dalesidea.com/uploads/1/3/0/5/130540208/buzid-zogusuwefileluf.pdf
    • http://christchurchveins.com/uploads/1/3/0/7/130775209/kibafuxizezenixegol.pdf
    • http://heartandhealthstudy.com/uploads/1/3/0/6/130640071/5327253.pdf
    • http://ghstyle.es/uploads/1/3/0/6/130604486/pawux.pdf
    • http://vl-capital.biz/uploads/1/3/0/5/130551235/lulanorokut.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edcc.bin
db6d27115d99b314b03c7a9fac269dada96f1662686273b9ea924d22a7382303		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDCC 11504 bytes
font_01_sfnt_off000111a0.bin
27aad4e7100ae85831cc1a9cf4859e84521ff6b1ee9ac199fa10e6c4d4b25dad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111A0 2736 bytes
font_02_sfnt_off00011b4d.bin
0caaf8a13e6bb7d0f0566d2530fe3a31e638f796423fa99914dfad88f64f05c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B4D 24708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.