Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ec97f394db30f0e…

MALICIOUS

PDF

38.6 KB Created: 2020-03-20 09:36:56 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ed3976931e62a6d611b8cf42d9489c38 SHA-1: 40fae1393b2a7a8f21936b92576589892de74a10 SHA-256: 5ec97f394db30f0e579e68274a14ad34239d9b57f636fa706bc0dc23acbdd197
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of external links, many of which point to other PDFs with numeric slugs, indicating a link farm or SEO abuse tactic. The primary embedded URL, http://meditatecreatestudio.com/uploads/1/3/0/2/130287529/130287529.html#whisper+10-30i+filter+cartridge, is also part of this network. This behavior suggests the document is designed to drive traffic to these sites, which could potentially host malicious content or further phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://meditatecreatestudio.com/uploads/1/3/0/2/130287529/130287529.html#whisper+10-30i+filter+cartridge
    • http://www.nmbathessentials.net/uploads/1/3/0/4/130476145/sakeba-lewuwe.pdf
    • http://paradisegardensofbr.com/uploads/1/3/0/6/130621083/judazipisib.pdf
    • http://planetoftalent.com/uploads/1/3/0/2/130288341/xufixam.pdf
    • http://mobilbar.de/uploads/1/3/0/6/130640194/1505557.pdf
    • http://jobseekerintel.com/uploads/1/3/0/6/130604741/153ffec796a4c5.pdf
    • http://in-house.studio/uploads/1/3/0/2/130288416/pavadabowe-bunufaxuv-lipunagiko.pdf
    • http://alive-tattoo.com/uploads/1/3/0/2/130291544/f0cff0777e794.pdf
    • http://sumicom.us/uploads/1/3/0/4/130476172/7655390.pdf
    • http://tusconssteakhouse.com/uploads/1/3/1/1/131163896/9563013.pdf
    • http://citymarketescaperoom.com/uploads/1/3/0/4/130489371/76abe26ecb76.pdf
    • http://dxva.com/uploads/1/3/0/6/130639197/peselib.pdf
    • http://tofinoucluelethomecare.com/uploads/1/3/0/3/130379319/ratotawa-nonekekewe-fugob-latebipe.pdf
    • http://f-ckprobably.com/uploads/1/3/0/5/130590224/9233189.pdf
    • http://mx.talloaksmontessori.com/uploads/1/3/0/9/130969209/beduvusunamuperij.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c84.bin
8bd617820e7080f6566dd85024ef7f73bccd9c48987b5b0ec7fd7d2f3be84a31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C84 8480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.