Malicious PDF — malware analysis report

Static analysis result for SHA-256 5be2724129769917…

MALICIOUS

PDF

41.9 KB Created: 2020-03-24 22:13:45 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c8add28c1509d3d93e43a5963cf33ff1 SHA-1: e5ed8f60196f7939222d9d534e2f75478461e90b SHA-256: 5be27241297699170ad28218d4edc08ffc45b595d85e12b8a476d017d46dcd1d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded links disguised as content related to network hardware setup. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm or redirection scheme. The ML classifier strongly flagged this PDF as malicious, and the presence of many unknown-reputation URLs points towards a phishing or redirection attack. No scripts were extracted from this sample, but the embedded links are the primary vector for malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://referral360network.com/uploads/1/3/0/7/130738892/130738892.html#how+to+setup+netgear+powerline+av+200
    • http://sarasierrahairextensions.com/uploads/1/3/0/4/130489830/1e66caed.pdf
    • http://caperteeheritage.com/uploads/1/3/0/6/130604386/5e2cd83.pdf
    • http://noblesrealtygrp.com/uploads/1/3/0/8/130813837/muxomi.pdf
    • http://youngproducedesign.com/uploads/1/3/0/2/130271153/7cf81b50bbe5440.pdf
    • http://www.mypartytime.info/uploads/1/3/0/6/130604725/dowupovuwoga_latemekopux_sorowagiro_zivelavodowov.pdf
    • http://claybirdmusic.com/uploads/1/3/0/9/130969182/7406177.pdf
    • http://cbdcreamonline.com/uploads/1/3/0/3/130323092/wuxejufetaxav.pdf
    • http://theideamonger.com/uploads/1/3/0/4/130483205/sabog_lonipiletod_xopixebe.pdf
    • http://007bondband.com/uploads/1/3/0/4/130476412/tavot.pdf
    • http://pescado-gabon.net/uploads/1/3/0/7/130776641/witokeguw-gegonozerabek-tutupexin-numowaxi.pdf
    • http://konnektuk.com/uploads/1/3/0/5/130589238/769875.pdf
    • http://innovationtv.net/uploads/1/3/0/5/130588437/f5f8007f19bd785.pdf
    • http://zacharyares.com/uploads/1/3/0/2/130272278/dagogan_wibejil_kiraganipu_vofibaxodumiga.pdf
    • http://watersidemusic.com/uploads/1/3/0/7/130776502/981899.pdf
    • http://infusionsafety.com/uploads/1/3/0/4/130475994/jemefexegokatebif.pdf
    • http://sibintcorp.com/uploads/1/3/0/6/130621447/vigus-texazimegiz-fitijuleta.pdf
    • http://rpmhomedelivery.com/uploads/1/3/0/6/130621228/b5f03c669c9.pdf
    • http://quicktakeoff.com/uploads/1/3/0/8/130873840/7185169.pdf
    • http://kohai.moe/uploads/1/3/0/4/130478609/gosidoxugetuba-dijabekamimo-webozusoxarubo.pdf
    • http://steamapaloozaccsd.org/uploads/1/3/0/7/130739704/sidenivavekik-xavaf-taruwiser-mukoku.pdf
    • http://howtheheckwouldiknowthat.com/uploads/1/3/0/4/130483376/2769916.pdf
    • http://muskmeloncreative.com/uploads/1/3/0/6/130621506/7318538.pdf
    • http://www.housecallshomeinspections.com/uploads/1/3/0/5/130551619/xojosubobidixut.pdf
    • http://www.xmo1.com/uploads/1/3/0/4/130490410/09232583cfc133.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007cfd.bin
824e7722a6eead099e2d5e2c08587145fdbaca28d17a68ffed154f1383bc4c32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CFD 7260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.