Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fd44235349040b1…

MALICIOUS

PDF

61.0 KB Created: 2020-03-24 13:36:35 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4d3b5da7f35dead11495eaea05a31cef SHA-1: 8ab0ba9370128c3557f656ff249f5cef7cb2dea9 SHA-256: 5fd44235349040b12065e4d16319e96d1205c0a6a18f631db233b58264bc19c4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a lure for a "Pearson mymathlab access code generator" which redirects to a PDF file. The heuristic 'PDF_SEO_LINK_FARM' indicates that this PDF is part of a large collection of similar PDFs, suggesting a link farm or SEO manipulation tactic. The ML classifier strongly flagged this PDF as malicious, and numerous external URLs were extracted, pointing towards a potential phishing or scam operation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://befreetherapy.com/uploads/1/3/0/5/130589237/130589237.html#pearson+mymathlab+access+code+generator
    • http://eileenburns.com/uploads/1/3/0/3/130313595/6782701.pdf
    • http://superfotoshop.com/uploads/1/3/0/6/130604986/c8c87e95e1.pdf
    • http://narasimha.co/uploads/1/3/0/5/130550838/favurepez-tafili-gilogabitu.pdf
    • http://dbrothschild.com/uploads/1/3/0/7/130776269/gutagos.pdf
    • http://rvkbon.net/uploads/1/3/0/6/130621569/345d06fcff.pdf
    • http://alkalignwellness.com/uploads/1/3/0/8/130815381/1173972.pdf
    • http://calicapitalgroup.org/uploads/1/3/0/8/130813799/1038617.pdf
    • http://e-comerciante.com/uploads/1/3/0/8/130874240/gozojikijejo-vefezurigoko.pdf
    • http://womeninlawdc.com/uploads/1/3/0/6/130639071/mumute.pdf
    • http://lakeforestcachamber.org/uploads/1/3/0/8/130813645/redibuwa.pdf
    • http://petvillagebrentwood.preview.pethealthnetworkpro.com/uploads/1/3/1/0/131071299/7792455.pdf
    • http://peacefultomorrow.net/uploads/1/3/0/7/130775892/wifezu_diwalebarukeb_sobujorudope_bewasitu.pdf
    • http://jeremyandkristina.com/uploads/1/3/0/5/130543262/jakafixarawofofa.pdf
    • http://swctoa.com/uploads/1/3/0/5/130539130/35bd6d.pdf
    • http://mail.wlanspots.de/uploads/1/3/0/8/130874533/wevasuxig-muxila.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c4f5.bin
9f1ce28f9d15423555984feaa9000205997479f64dc5c4cba219b8020631dae6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC4F5 8712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.