Malicious PDF — malware analysis report

Static analysis result for SHA-256 5031681f6f059b45…

MALICIOUS

PDF

36.6 KB Created: 2020-04-04 12:08:11 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-04
MD5: ab3718c7499d08d6b016efcca8d3a2f5 SHA-1: 7d69fbfd5f83ff2a14e4f57e26a31de15ff777ba SHA-256: 5031681f6f059b45db3a2cb884be38f8b2ab10355257c627babf054a17301cab
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links to other PDF files hosted on various domains, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves directing users to a link farm of potentially harmful documents.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://scruggsmetalworks.com/uploads/1/3/0/7/130776457/130776457.html#speed+queen+washing+machine+parts+diagram PDF link annotation
    • http://centrojazzalba.com/uploads/1/3/0/2/130289387/bce85afb6a005fc.pdfIn PDF document text
    • http://cybersecuritynews.us/uploads/1/3/0/7/130776174/fugilop.pdfIn PDF document text
    • http://kirkpinar.info/uploads/1/3/0/2/130287424/4181480.pdfIn PDF document text
    • http://vintagechicdiamonds.com/uploads/1/3/0/6/130604688/6ec98101.pdfIn PDF document text
    • http://nymica.com/uploads/1/3/1/3/131378776/lubonemisafuko.pdfIn PDF document text
    • http://yorbalakepetclinic.com/uploads/1/3/1/4/131414561/6704023.pdfIn PDF document text
    • http://wamlcrafts.com/uploads/1/3/0/4/130488875/tewenu_gigavi_katodafogazot.pdfIn PDF document text
    • http://furevents.melbourne/uploads/1/3/0/6/130621304/motogazidulapa.pdfIn PDF document text
    • http://alendinghandseniorliving.net/uploads/1/3/1/0/131069766/lexavolozogu.pdfIn PDF document text
    • http://isobelpigott.com/uploads/1/3/0/6/130639703/maseninifip-gorokiruji-gakupipiwe.pdfIn PDF document text
    • http://e3financial.org/uploads/1/3/0/4/130483581/6910434.pdfIn PDF document text
    • http://digitalhustleblueprint.com/uploads/1/3/0/7/130775730/bamara.pdfIn PDF document text
    • http://tyleryonge.com/uploads/1/3/0/7/130740440/bafemabekixu_wexedarerukeziv_zapaloferigek.pdfIn PDF document text
    • http://khaliafrazier.com/uploads/1/3/0/6/130639824/8553490.pdfIn PDF document text
    • http://vintageviews.net/uploads/1/3/0/3/130323937/8559451.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x67D3 7508 bytes
SHA-256: 4ff71b79351566cfc36f6d9e8281f372ce7f003d4bff5731a3c4ac2e8efb9a18