Malicious PDF — malware analysis report

Static analysis result for SHA-256 49a56bd727b5b3c1…

MALICIOUS

PDF

40.2 KB Created: 2020-03-28 09:57:24 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e25184fe3207f2fecf6c46f741eff251 SHA-1: 4f1d465677aa6bd599eb13714d9dece1d205008a SHA-256: 49a56bd727b5b3c1bf3b48bd739dc53210285f060d6ff03a0d6236ad24d55f5a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body, though partially corrupted, suggests a theme of 'experiment reports' which is likely a lure to encourage users to click on the embedded links. The ML classifier strongly indicates maliciousness. The primary attack pattern involves directing users to a network of linked websites, likely for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hardhathomeinspection.com/uploads/1/3/0/6/130621965/130621965.html#partes+que+conforman+un+informe+de+experimento
    • http://welcome-fp.com/uploads/1/3/0/6/130604247/c65a0db7127.pdf
    • http://www.50plussguiden.no/uploads/1/3/0/3/130324011/9771784.pdf
    • http://subgloves.net/uploads/1/3/0/6/130639157/0d81168f81.pdf
    • http://americanrollingdoors.net/uploads/1/3/0/6/130604363/wajapatovopezozazu.pdf
    • http://www.makingitfromsunuptosundown.com/uploads/1/3/0/8/130874295/2a8207f30.pdf
    • http://ns2.hazeltones.com/uploads/1/3/0/7/130739072/takujamasuruwuz.pdf
    • http://homeahound.com/uploads/1/3/0/6/130639518/dunulewetogova_bitifax_dinal_buzoforob.pdf
    • http://www.745217932489560.com/uploads/1/3/0/6/130605292/notoxajilafalef-depotedifal.pdf
    • http://rexburgflooring.com/uploads/1/3/0/2/130270866/741a050.pdf
    • http://mylsathouse.com/uploads/1/3/1/3/131380054/3194316.pdf
    • http://masterdisty.com/uploads/1/3/0/4/130478203/juwikatabetovij.pdf
    • http://successanalytics.net/uploads/1/3/1/1/131164481/4468514.pdf
    • http://minimalmac.net/uploads/1/3/0/5/130543771/6447708.pdf
    • http://www.divineenergychurch.com/uploads/1/3/0/5/130550700/1361199.pdf
    • http://charliechub.org/uploads/1/3/0/2/130274146/6619236.pdf
    • http://www.houseofwrapsca.com/uploads/1/3/0/2/130287407/e320201c4.pdf
    • http://ddoservicesinc.com/uploads/1/3/0/2/130288380/botositetusoboba.pdf
    • http://justincdavismusic.com/uploads/1/3/0/5/130547515/4c9540794e.pdf
    • http://marijuanaexchangemarket.com/uploads/1/3/0/7/130775284/e0a4d1371.pdf
    • http://deannalindstrom.com/uploads/1/3/0/6/130620233/f532d01.pdf
    • http://idforensics.net/uploads/1/3/0/7/130739578/rusapoduxixides.pdf
    • http://chrisfaraji.com/uploads/1/3/0/6/130605383/wusurifaxes.pdf
    • http://drjessejacobs.com/uploads/1/3/0/6/130639547/jujunipipile.pdf
    • http://sarahrowland2089.com/uploads/1/3/0/6/130604678/9480773.pdf
    • http://sarahrowland2089.com/uploads/1/3/0/6/130604678/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072b5.bin
b166b06175ef3222fc5fe3ccc6ba6e821ad5ab252417a46054e3dc5e22b701a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72B5 8800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.