Malicious PDF — malware analysis report

Static analysis result for SHA-256 51e833bc3f8f4858…

MALICIOUS

PDF

46.0 KB Created: 2020-03-11 13:56:35 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 2d67b3c31b86df8773e33f45ba20df63 SHA-1: a3d6e1d39e15419c3e180bba557fd835f57ec596 SHA-256: 51e833bc3f8f4858144a9b8acee260d363ab159a0718fadfb031dec6fc71d1ea
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are dynamically generated and point to PDF files hosted on unrelated domains. This pattern is indicative of a link farm used for SEO poisoning or to distribute malicious content. The document body, though partially corrupted, contains a URL that appears to be the primary lure, referencing 'sickle cell disease gene' to mask the malicious intent. No scripts were extracted, but the extensive link farm suggests a campaign focused on driving traffic to potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-72-229.mgwnet.com/uploads/1/3/0/8/130873923/130873923.html#sickle+cell+disease+gene
    • http://discoveringmytrueself.com/uploads/1/3/0/6/130620857/4013605.pdf
    • http://lovelustboudoir.com/uploads/1/3/0/8/130874430/fuzipen.pdf
    • http://nurseeducators.net/uploads/1/3/0/6/130605381/zimaw.pdf
    • http://sytrpa.com/uploads/1/3/0/4/130436094/japowavul_munalavefi_jafeduzo_kogisiramixur.pdf
    • http://www.mysplendidfailure.com/uploads/1/3/0/2/130292148/dejukaxikebad.pdf
    • http://mail.columbuscoasterco.com/uploads/1/3/0/5/130542773/4826789.pdf
    • http://thesteaklab.com/uploads/1/3/0/5/130590363/girawejijagowe.pdf
    • http://homesforwv.org/uploads/1/3/0/5/130551599/wupoxorup_kulakekalapuku_kizujuzosud_fibitugosizure.pdf
    • http://sellmdlive.com/uploads/1/3/0/5/130541688/4d1b03a1b2a0.pdf
    • http://www.classidisocializzazione.org/uploads/1/3/0/5/130544790/c66bf881a05e1.pdf
    • http://mta-sts.mail.toyislepawleys.com/uploads/1/3/0/9/130969623/2181686.pdf
    • http://mpsi-yar.ru/uploads/1/3/0/5/130539229/vovawobol.pdf
    • http://preview.theepicremedy.com/uploads/1/3/0/2/130291838/6089847.pdf
    • http://kaleidoscope-style.com/uploads/1/3/1/0/131070933/996304.pdf
    • http://pwhs.prowrestlinghistoricalsociety.com/uploads/1/3/0/7/130739463/fujanajewimeri-jalewan-vovifotuxatewo-dowazo.pdf
    • http://laceyandleatherexoticattirellc.com/uploads/1/3/0/5/130588366/20f7e2f9e6d16f0.pdf
    • http://aiasciencemagazine.com/uploads/1/3/0/5/130539841/major-navuxasazedun.pdf
    • http://wordme.co/uploads/1/3/0/4/130488228/najadibumelalos.pdf
    • http://www.waldemarbastos.net/uploads/1/3/0/5/130543483/tapokosu.pdf
    • http://krissyoneill.com/uploads/1/3/0/4/130476145/nesop.pdf
    • http://clairajacksonartist.com/uploads/1/3/0/8/130814043/7361682.pdf
    • http://weinisiguanfangwang.f18.ebkf.org/uploads/1/3/0/2/130273791/dikiwov-kokabezenetu-binot.pdf
    • http://grouperdate.com/uploads/1/3/0/6/130621893/teduxegumikurit-kejod.pdf
    • http://www.campuscleaningireland.com/uploads/1/3/0/5/130544584/2144608.pdf
    • http://grouperdate.com/uploads/1/3/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008b3a.bin
afcf34a89e04b2d50dcf9ec468cbdaf1eb4f931ab8a557b47bb201dd9a84462b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B3A 8072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.