Malicious PDF — malware analysis report

Static analysis result for SHA-256 43b121d85a79d990…

MALICIOUS

PDF

36.1 KB Created: 2020-03-25 10:31:39 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 07b396db7588f321a09f7132d3822dfb SHA-1: 95a9c3d269ed8e84fd40cce99140deeab2d8a3cd SHA-256: 43b121d85a79d990016c6f8275c7f8ec41aa69aa23655dff0137a9ca4913556e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous external links, many of which are structured to appear as SEO-optimized content, suggesting a link farm or SEO spam operation. The document body, though partially corrupted, contains references to a 'Dyson dc25 user manual', which is likely a lure to encourage clicks on the embedded malicious URLs. The ML classifier strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fyimetrics.com/uploads/1/3/0/5/130588720/130588720.html#dyson+dc25+user+manual
    • http://www.legendarymotorcar.net/uploads/1/3/0/8/130814462/kugalofuzevuvi.pdf
    • http://pcs-ddd.co.uk/uploads/1/3/0/7/130775198/tepuvujujovofep_geforabaperikak.pdf
    • http://trauma-toolkit.com/uploads/1/3/0/7/130738913/fufapuv.pdf
    • http://lpluslsigns.com/uploads/1/3/0/5/130550681/984018.pdf
    • http://toominty.com/uploads/1/3/0/3/130313671/vipuk-jemarubawujekis-puleketobugaf.pdf
    • http://www.hiebardesign.com/uploads/1/3/0/6/130620356/lerepasorif.pdf
    • http://mx.mx.fullspeedahedge.com/uploads/1/3/0/3/130379104/847262.pdf
    • http://balihaidreams.com/uploads/1/3/0/7/130776603/9553061.pdf
    • http://muttsearmitts.com/uploads/1/3/0/7/130739462/6436334.pdf
    • http://rustic-farmhouse.com/uploads/1/3/0/5/130590637/b6833c9ebe.pdf
    • http://www.ninedec.com/uploads/1/3/0/5/130550715/bivotatup_weledisabuwoxot.pdf
    • http://propowerwashingllc.com/uploads/1/3/0/4/130435520/vupogasawipi_foxiledigagefow.pdf
    • http://balancedforlifeyogatherapy.com/uploads/1/3/0/4/130490277/11c9fa9.pdf
    • http://jillianplayer.com/uploads/1/3/0/4/130483341/tubelalolewuf_daretonuzalu.pdf
    • http://studio116thesalon.com/uploads/1/3/0/6/130604589/7575207.pdf
    • http://ns2.vmrs.org/uploads/1/3/0/3/130323822/pegajibizuwuvole.pdf
    • http://misscarladance.org/uploads/1/3/0/7/130739254/gopelumewo.pdf
    • http://betterbeautyandbeyond.com/uploads/1/3/1/3/131383602/zutezidezopekutu.pdf
    • http://stremis.net/uploads/1/3/0/7/130775927/3263156.pdf
    • http://geriatricmodelingclub.com/uploads/1/3/0/3/130312973/sodajob-jagoluwisiwina-ranesudebojon.pdf
    • http://justin-cindy.com/uploads/1/3/0/7/130775277/8564097.pdf
    • http://thesaladmander.com/uploads/1/3/0/7/130775443/topituburevalal.pdf
    • http://joiaspinelli.com/uploads/1/3/0/2/130287419/7802c7033f9b890.pdf
    • http://www.strongbabefit.com/uploads/1/3/0/3/130323597/vutilu-puxesibufopifir-rodifuloliroz.pdf
    • http://ww2.robertchristianmoreno.com/uploads/1/3/0/3/130323789/kudetutin.pdf
    • http://www.strongbabefit.com/uploads/1/3/0/3/130323597/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006505.bin
0748a29fb105930c2ce1f7225ee8c3d1e3224e1472b38247662bf3067edf9db7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6505 7560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.