Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ecd25e9bab1c2de…

MALICIOUS

PDF

38.4 KB Created: 2020-04-08 10:10:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7a967cbcf77d0546c4befd0f4efefeea SHA-1: a4427e9179bcaa0501152f9999f9f546e80387c9 SHA-256: 5ecd25e9bab1c2de71ef65e1c34102c3425d93a00723c03e41152ebac651f422
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to host malicious content. The document body, though heavily obfuscated, contains a URL that mimics a property tax search, likely a lure to encourage users to click on the embedded links. The ML classifier strongly indicated maliciousness, and the PDF structure suggests it's part of a link farm designed to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://frieslandgastvrij.nl/uploads/1/3/0/6/130621102/130621102.html#chester+county+pa+tax+assessor+property+search
    • http://futbol-tips.com/uploads/1/3/0/5/130590475/4285932.pdf
    • http://stemhighschoolchattanooga.com/uploads/1/3/1/3/131378816/jonaluwugiduxenejozo.pdf
    • http://starcustomsgr.com/uploads/1/3/1/4/131410434/tojewum_gadobi_vipaxabab_xajevolixaxij.pdf
    • http://chaocollegeconsulting.com/uploads/1/3/1/3/131379636/d884c1b238534.pdf
    • http://moving-is-easy.com/uploads/1/3/1/3/131384696/f649945bdecd6e.pdf
    • http://mullenformullica.com/uploads/1/3/0/5/130542728/losunito.pdf
    • http://aga-mix.com/uploads/1/3/0/5/130588207/c544f6c11ca1.pdf
    • http://xnadu.com/uploads/1/3/1/4/131452837/0858493e66.pdf
    • http://ellecante.com/uploads/1/3/1/3/131384468/vutil_tegipajelikewa_repem.pdf
    • http://thebellyisboss.com/uploads/1/3/1/3/131379439/kugiwonizo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000680c.bin
65bed38c245f1ef4321a3465d73cdabeda1b39e31f34fe7653d21eb7897bda98		 pdf-font-stream PDF embedded font (sfnt) at offset 0x680C 9268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.