Malicious PDF — malware analysis report

Static analysis result for SHA-256 5690c6d049a58b5a…

MALICIOUS

PDF

38.6 KB Created: 2020-05-14 20:30:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-08-25
MD5: 624da38b0ef3cd1e286ce119a07aa63b SHA-1: 91f72f6d4634f3dd6b4284947c422c53bc8189fc SHA-256: 5690c6d049a58b5ac77eeda2e8206b2aeba52c1fdc982bbfd1e954ae2cf65d9f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used for SEO poisoning to drive traffic to malicious sites. The document body itself is heavily obfuscated but contains references to exam forms and dates, suggesting a lure. The primary heuristic indicates a PDF link farm, with many URLs pointing to PDF files hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kindkvist.com/uploads/1/3/1/1/131163834/131163834.html#cbse+improvement+exam+form+filling+date PDF link annotation
    • http://mosaichappy.com/uploads/1/3/0/8/130874591/2996888.pdfIn PDF document text
    • http://thelashboratory.com/uploads/1/3/1/3/131384227/8050303.pdfIn PDF document text
    • http://customcastsystems.com/uploads/1/3/0/3/130323295/juvir.pdfIn PDF document text
    • http://childrensworkforceconsultancy.com/uploads/1/3/0/7/130739150/324a4617e0c555.pdfIn PDF document text
    • http://iuacademy.com/uploads/1/3/0/6/130604185/pedinifures-fosewagud-buvoxifo-nolukubuko.pdfIn PDF document text
    • http://simpleedesign.com/uploads/1/3/0/7/130740497/nizafi.pdfIn PDF document text
    • http://cuffedbyjewels.com/uploads/1/3/0/6/130603676/dobomuwitodivi.pdfIn PDF document text
    • http://ctransformhealth.com/uploads/1/3/0/8/130874113/3211573.pdfIn PDF document text
    • http://legalpt.com/uploads/1/3/1/4/131406480/b3e7e2a4b.pdfIn PDF document text
    • http://carolwatsonmiller.com/uploads/1/3/1/8/131856119/fuvamaxikifu-tolata-sagisuf.pdfIn PDF document text
    • http://seikerinternational.com/uploads/1/3/1/6/131637178/2a369b83ee6de5.pdfIn PDF document text
    • http://lubbockfloresflowers.com/uploads/1/3/0/9/130969686/7864921.pdfIn PDF document text
    • http://pattenacademy.net/uploads/1/3/0/4/130488114/dubib.pdfIn PDF document text
    • http://resurrectionmusem.com/uploads/1/3/1/4/131407849/pajuwobogibudul.pdfIn PDF document text
    • http://richardpeterharrison.com/uploads/1/3/1/4/131454771/4fec4f39634.pdfIn PDF document text
    • http://simeonspeaks.com/uploads/1/3/0/6/130605399/bogaxuwevudusim.pdfIn PDF document text
    • http://bandbcleaningservices.com/uploads/1/3/0/3/130313089/0624cd264bd2f8f.pdfIn PDF document text
    • http://omeraziz.com/uploads/1/3/0/3/130379163/8f226195273c.pdfIn PDF document text
    • http://defenderpolicesupply.net/uploads/1/3/0/4/130483215/923017.pdfIn PDF document text
    • http://thejohnstonbuilding.com/uploads/1/3/0/6/130639980/gudagunif-gumefe-kunopanubere-kojuxaru.pdfIn PDF document text
    • http://thebossbabenetwork.com/uploads/1/3/0/7/130775704/3586166.pdfIn PDF document text
    • http://collaborate.care/uploads/1/3/0/4/130489228/rodapimerafuw.pdfIn PDF document text
    • http://steamplayground.org/uploads/1/3/0/5/130543462/2caff6467ed8b5.pdfIn PDF document text
    • http://dogtownemarket.com/uploads/1/3/0/4/130476006/7ede1be12f000b6.pdfIn PDF document text
    • http://tweste.com/uploads/1/3/0/3/130313170/2202489.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x69D6 10744 bytes
SHA-256: f34b95fb4f02558b281b5a2fe427ed90a8d4059b5b785b87aacaa660d9df915a

Open this report in the interactive analyzer, or submit your own file for analysis.