Malicious PDF — malware analysis report

Static analysis result for SHA-256 51eb6b2d88125928…

MALICIOUS

PDF

42.1 KB Created: 2020-03-25 07:14:40 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: cdbea55d9669bb755e5ae3f354fdc2d8 SHA-1: 4efa73cb1fb46a513c8f2003d04ca323a39b8314 SHA-256: 51eb6b2d881259284b4088c4fd6a15216b5aa2d217c5b5b0f205c958c67cd5f6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was generated by wkhtmltopdf and contains a large number of external links, many of which point to other PDFs hosted on similar domains. The primary URL in the document body, http://neokundalini.org/uploads/1/3/0/8/130813366/130813366.html#como+dividir+la+hoja+de+word+en+2+vertical, is part of a link farm designed to manipulate search engine results. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is part of a link-farming or SEO manipulation scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neokundalini.org/uploads/1/3/0/8/130813366/130813366.html#como+dividir+la+hoja+de+word+en+2+vertical PDF link annotation
    • http://newmexicolegalhelp.com/uploads/1/3/0/8/130814258/figupawosoven_nedinis_wepil.pdfIn PDF document text
    • http://www.socialissues.online/uploads/1/3/0/6/130604049/vudasuj.pdfIn PDF document text
    • http://beautifulgateinternational.org/uploads/1/3/0/9/130969916/0e420faecb.pdfIn PDF document text
    • http://www.deluxefrenchfries.net/uploads/1/3/0/3/130323227/rozadetikos_fibudokutozu.pdfIn PDF document text
    • http://www.irwincreations.com/uploads/1/3/0/5/130543032/jajilibimutuf_marowomef.pdfIn PDF document text
    • http://mrsmalloy.info/uploads/1/3/0/2/130291838/0c2eb94.pdfIn PDF document text
    • http://sharkdinghy.com/uploads/1/3/0/7/130739601/gibosexorixu.pdfIn PDF document text
    • http://syncopatedance.com/uploads/1/3/0/6/130604582/navafikozalew.pdfIn PDF document text
    • http://blunderist.com/uploads/1/3/0/4/130478057/6673759.pdfIn PDF document text
    • http://juneau-dining.com/uploads/1/3/0/4/130475996/7444886.pdfIn PDF document text
    • http://digitalsqueak.com/uploads/1/3/0/7/130775752/4514190.pdfIn PDF document text
    • http://hostmaster.pmlconnect.co.uk/uploads/1/3/0/3/130379292/2094208.pdfIn PDF document text
    • http://saegl.us/uploads/1/3/0/6/130621995/5c4df.pdfIn PDF document text
    • http://lifespiritswisdom.com/uploads/1/3/0/6/130639822/14803149.pdfIn PDF document text
    • http://squareonefurnishings.com/uploads/1/3/0/7/130776520/noripetimiwanoma.pdfIn PDF document text
    • http://oakridgestables.co.uk/uploads/1/3/0/2/130270804/8543954.pdfIn PDF document text
    • http://decormoreno.com/uploads/1/3/0/5/130551607/3179068.pdfIn PDF document text
    • http://sally-fox.com/uploads/1/3/0/4/130483216/nuwotebunude-fetotod.pdfIn PDF document text
    • http://www.1998skateboards.com/uploads/1/3/0/8/130815013/642f4fbb37dd01.pdfIn PDF document text
    • http://xodessertsandbakery.com/uploads/1/3/0/7/130739695/rupov.pdfIn PDF document text
    • http://warmnightcandles.com/uploads/1/3/0/7/130739782/ea2e9.pdfIn PDF document text
    • http://mail.unioncountyfair.org/uploads/1/3/0/5/130540725/774337c.pdfIn PDF document text
    • http://gcoups.com/uploads/1/3/0/3/130379199/1610261.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d98.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D98 8144 bytes
SHA-256: 99ea24fea4e107fbf55b9e3f6c4f95f19dc7fb05d076c69cae16cf39e839ffb4
font_01_sfnt_off00008b36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8B36 4144 bytes
SHA-256: 885781ec91db75dc8c4a6a3d3dac0324bdfdb8f2239dab70466c62035ae072da

Open this report in the interactive analyzer, or submit your own file for analysis.