Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d206aeae6aafa13…

MALICIOUS

PDF

49.2 KB Created: 2020-03-13 04:39:38 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8a7f7c2ccede234345266a8221fa4e81 SHA-1: 00116045f000c7d710c074600440f421711732dd SHA-256: 5d206aeae6aafa131569fb74887d301b471342e6879eb8e97ee4b45bedc08da1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by an ML classifier and contains a large number of external links, suggesting a link farm or SEO manipulation tactic. The document body contains a URL that appears to be a lure for 'BBC learning English pronunciation tips download'. No scripts were extracted, but the presence of numerous external links indicates a high likelihood of redirecting users to potentially malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lynne-simpson.pleasingfood.com/uploads/1/3/0/3/130313748/130313748.html#bbc+learning+english+pronunciation+tips+download
    • http://africanessencehairstylesbyann.org/uploads/1/3/0/5/130551053/nifogudu.pdf
    • http://www.pbadvice.com/uploads/1/3/0/6/130621682/d4d0ccc31d4.pdf
    • http://3505brunell.org/uploads/1/3/0/7/130739032/1f7901681.pdf
    • http://tubebending.info/uploads/1/3/0/6/130604556/kevobob.pdf
    • http://g2staging.com/uploads/1/3/0/7/130739520/7eaf7d.pdf
    • http://www.vujahday.com/uploads/1/3/0/2/130272485/6041223.pdf
    • http://www.californiawineryshuttle.com/uploads/1/3/0/4/130483305/rumudaluboluv-mipod.pdf
    • http://facebetter.com/uploads/1/3/0/6/130604793/domixasezubim-basazop-wotonozeka-kodezegineziker.pdf
    • http://liganacionaldegalgos.com/uploads/1/3/0/3/130312951/janoke.pdf
    • http://justjewelrybyivy.com/uploads/1/3/0/8/130814754/9123569.pdf
    • http://erinmettille.com/uploads/1/3/0/2/130274076/1966666.pdf
    • http://yushanyulecheng.f18.ebkf.org/uploads/1/3/0/6/130621194/03eac949.pdf
    • http://slushproductions.com/uploads/1/3/0/6/130620561/nukitanumodu.pdf
    • http://chichippieproductions.net/uploads/1/3/0/7/130776699/zumeluwunavorimovas.pdf
    • http://puretranquility.net/uploads/1/3/0/6/130620712/a0e917fd1bf4031.pdf
    • http://abdelbassitsenhadji.com/uploads/1/3/0/2/130288644/3580236.pdf
    • http://www.janelmorrison.ca/uploads/1/3/0/4/130435881/7870032.pdf
    • http://simfov.com/uploads/1/3/0/3/130324206/5c44c9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007211.bin
56249754a8375cae4b7bcf20ae7d10f401764755b81dd212034bf83662caac6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7211 8144 bytes
font_01_sfnt_off00009164.bin
11eff0542ee112a7a4f3d5fa86892f13f7f7c80edb17354215cea33bb7714487		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9164 2768 bytes
font_02_sfnt_off00009b2e.bin
4e31ecec440e407ada0d7c481d556d28b78a564c60bc13fc85681888e0caf72d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B2E 17160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.