Malicious PDF — malware analysis report

Static analysis result for SHA-256 4169753cc32760c6…

MALICIOUS

PDF

43.4 KB Created: 2020-03-16 02:23:01 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: dc239ae6b34df4a75687db76f45e1b2d SHA-1: ce76145f477d1cd88b7fc07bd91f9806367e47a6 SHA-256: 4169753cc32760c63a2aaa137f2a30935c09764025b9c2772c1ada1d461633f4
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which are dynamically generated and point to PDF files. The document body references 'Ccleaner pc full version', suggesting a lure to download software. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of generated links, likely for SEO manipulation or to host malicious content. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://x0955303xstreamtravel.xsideas.com/uploads/1/3/0/2/130287529/130287529.html#ccleaner+pc+full+version
    • http://zfmcqog.av.play-tw.com/uploads/1/3/0/2/130289243/monovexutipukosoxowo.pdf
    • http://miseniorcenters.com/uploads/1/3/0/4/130476649/6db5faa.pdf
    • http://aandnlawn.com/uploads/1/3/0/7/130738596/pemibov.pdf
    • http://odontologiaparapets.com/uploads/1/3/0/6/130604560/xulosazeri.pdf
    • http://www.girlsjustwannadraw.com/uploads/1/3/0/6/130621836/8089674.pdf
    • http://short-commute-home.com/uploads/1/3/0/6/130603954/xifutotizo.pdf
    • http://lamsportstherapyyork.com/uploads/1/3/0/5/130542875/kodemamoge.pdf
    • http://www.ehammercounseling.com/uploads/1/3/0/2/130287735/wejatabuva.pdf
    • http://xileart.com/uploads/1/3/0/4/130488820/zupawafezopuremiso.pdf
    • http://aandeapothecary.com/uploads/1/3/0/7/130776812/zaruritu.pdf
    • http://noahsusskind.net/uploads/1/3/0/6/130604083/4073175.pdf
    • http://briarmoorpool.com/uploads/1/3/0/2/130289774/5603745.pdf
    • http://onetimeweardresses.com/uploads/1/3/0/5/130588589/pisobufa.pdf
    • http://www.northernvocalcoaching.com/uploads/1/3/0/6/130604689/aacb5aae4c.pdf
    • http://theultimatehumanpotential.com/uploads/1/3/0/3/130313186/8261530.pdf
    • http://www.bodyoilsdirect.com/uploads/1/3/0/5/130543813/6655256.pdf
    • http://lillgallery.com/uploads/1/3/0/6/130603975/9720118.pdf
    • http://www.ilfiloderbapsicomotricita.com/uploads/1/3/0/3/130380037/toxuxulutaxuvu-lelidudebav-baleloxo.pdf
    • http://thesocceridcamp.com/uploads/1/3/0/2/130287738/d708598b70a.pdf
    • http://beatbunkr.com/uploads/1/3/0/3/130379757/ef3b98988.pdf
    • http://mail.mackenziefreed.com/uploads/1/3/0/3/130323196/malixigilumemonu.pdf
    • http://www.wildflowertackandleather.shop/uploads/1/3/0/6/130621279/6136246.pdf
    • http://safedrivingschool.net/uploads/1/3/0/4/130483146/wejojinegibizomi.pdf
    • http://nationalrealestategroup.org/uploads/1/3/0/5/130588396/bimosarogobutal.pdf
    • http://themistt.com/uploads/1/3/0/6/130605107/vobuzinom.pdf
    • http://nationalrealestategroup.org/uploads/1/3/0/5/13058839
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007e92.bin
699329f5fff18f2cd3c9e4a4b1a032ee12fec7bbfa28e2c620690648c1df5e36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E92 8176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.