Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b708dff0e62e550…

MALICIOUS

PDF

40.9 KB Created: 2020-03-07 20:13:12 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3b1410e74887a5022ea4163d80a3ba78 SHA-1: 1072f9e0f31e289f3f593ba070d519e134695691 SHA-256: 5b708dff0e62e55058b1e3acf5377b5858eb6fb3b5f8b2fd6163f23fe6b94a53
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a large number of embedded links to external PDF documents hosted across various domains. The heuristic 'PDF_SEO_LINK_FARM' indicates this is likely an attempt to manipulate search engine results or distribute malicious content through a link farm. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xrossingborders.net/uploads/1/3/0/3/130323130/130323130.html#different+layers+of+earth+atmosphere
    • http://rob-harrisblog.com/uploads/1/3/0/5/130550857/sonamowakamajur.pdf
    • http://www.winniethevan.com/uploads/1/3/0/7/130776817/poporen.pdf
    • http://vividstrength.com/uploads/1/3/0/5/130544067/lalavugewagogojosidu.pdf
    • http://thefrothcompany.com/uploads/1/3/0/9/130970014/7fdcb4fc.pdf
    • http://cbbankclassic.com/uploads/1/3/0/7/130738735/neraxixanerel-najasajapob.pdf
    • http://cumberlandluxuryhomes.com/uploads/1/3/0/9/130969852/nevujoxi_tuzafedewiwolu_mapajepunatew_lopoba.pdf
    • http://crispmas.com/uploads/1/3/0/2/130288559/renonek_vetotujafase_riguxej.pdf
    • http://autodiscover.jerseygod.com/uploads/1/3/0/7/130775384/ruwikumajoripakuzuri.pdf
    • http://organicroyalty.com/uploads/1/3/0/5/130551206/6bb8428.pdf
    • http://majorrobot.net/uploads/1/3/0/8/130873921/maxid_jusodokex_pimile_serabagin.pdf
    • http://nurtureministries.com/uploads/1/3/0/5/130588437/e6d7e4d.pdf
    • http://152811427883146431.com/uploads/1/3/0/7/130776420/88bc677e.pdf
    • http://prophits.net/uploads/1/3/0/6/130604626/gukuresupaxadiz.pdf
    • http://reyvu.com/uploads/1/3/0/7/130739218/rizoguporufekevuzodu.pdf
    • http://stellarnonprofits.com/uploads/1/3/0/5/130551057/kikojibomijiboxavevu.pdf
    • http://colombiatlc.com/uploads/1/3/0/7/130738914/xujagizonakof.pdf
    • http://my2degrees.nl/uploads/1/3/0/2/130287266/sivujuwanumake.pdf
    • http://backroadcreations.com/uploads/1/3/0/4/130483320/986999.pdf
    • http://reneteassuredtitleagency.us/uploads/1/3/0/6/130604859/2179259.pdf
    • http://sb10bootcamp.com/uploads/1/3/0/8/130814292/vuxolaxaziz.pdf
    • http://yalcinerserhan.com/uploads/1/3/0/7/130739423/ruxosaxukikawo.pdf
    • http://sjsldetroit.org/uploads/1/3/0/4/130483422/fasalolejabekus.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077c4.bin
d372207364250b95fb3bdb63b265195df054b4e5ffe85865a15457dd37314d82		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77C4 7252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.