Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b408beb35c03e2d…

MALICIOUS

PDF

46.3 KB Created: 2020-03-20 05:07:34 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 34c010c0575552cf2b21cd5e1fede432 SHA-1: a717eb509c1d1da8d39b08ecc364dd516ce506b8 SHA-256: 5b408beb35c03e2d7587c435220175889bec8b95f17d6c65e11f7dcce8e4277e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used for SEO spam or phishing campaigns. The document body, though obfuscated, contains text suggesting it is an instruction manual, which serves as a lure to click on the embedded URLs. The ML classifier strongly indicated maliciousness, and the presence of many external links points towards a link-farming or redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://totallydreams.com/uploads/1/3/0/4/130490561/130490561.html#k%27nex+rippin+rocket+roller+coaster+instruction+manual
    • http://www.engineeringgts.com/uploads/1/3/0/2/130287314/xugugo-detibagor-pavegitine-depugu.pdf
    • http://brookity.org/uploads/1/3/0/6/130620690/3703547.pdf
    • http://joshschoonmaker.com/uploads/1/3/0/5/130543772/ced2f1a30dc.pdf
    • http://groceryexpansioninlandempire.com/uploads/1/3/0/9/130969647/nulawodolewafotaga.pdf
    • http://www.tradecompliant.com/uploads/1/3/0/2/130272406/narepo.pdf
    • http://thegreyhouseemporiumonline.com/uploads/1/3/0/5/130539165/9298790.pdf
    • http://zendma.com/uploads/1/3/0/3/130313293/71782179ec3b31.pdf
    • http://longhorncajun.com/uploads/1/3/1/0/131070171/bumikavefekis_defujapufugiruz_xofajibad.pdf
    • http://avnsolutions.com/uploads/1/3/0/5/130540477/cc0a6a6f.pdf
    • http://cloverlegacy.com/uploads/1/3/1/1/131163725/sarigalogo_latizeso.pdf
    • http://naualli.net/uploads/1/3/0/6/130621225/8995394.pdf
    • http://thevitazen.com/uploads/1/3/0/6/130604666/a6934ad7f9db.pdf
    • http://dhastie.com/uploads/1/3/0/7/130776484/f60c0.pdf
    • http://healthyriding.org/uploads/1/3/0/7/130776728/rabojipajijan-mitot.pdf
    • http://www.powerfuldiscipline.org/uploads/1/3/0/7/130739362/9560080.pdf
    • http://www.three1.net/uploads/1/3/0/7/130775231/b88db.pdf
    • http://mx.thefancypigeon.com/uploads/1/3/0/9/130969624/1807593.pdf
    • http://radiantsoulrecords.com/uploads/1/3/0/7/130776847/zizaw_sagijetefob_bibobixexef.pdf
    • http://mestizostacos.com/uploads/1/3/0/2/130274282/5305bd.pdf
    • http://ninjamindfulness.com/uploads/1/3/0/8/130814675/nawape-boruf-pozetizugi.pdf
    • http://mail.bemisfarmsnursery.com/uploads/1/3/0/5/130590432/5c324322791c81.pdf
    • http://www.qbaby1314.shop/uploads/1/3/0/7/130739996/xasabamusogojux-wuwiropajizino-jiguvex.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008855.bin
008c65a92ceabcb66e4379f48e2818d954a429ed1d6565b70296688539ac9d46		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8855 9388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.