Malicious PDF — malware analysis report

Static analysis result for SHA-256 61523073867600fc…

MALICIOUS

PDF

76.5 KB Created: 2020-03-27 01:59:09 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: fc4ca5192954b700695498bc455fc3d7 SHA-1: 392a08eb5e14b37f76c7218ee41b74011cbd148d SHA-256: 61523073867600fcf2b517ce4e58a86a6a6159c4e676383a2985d4c4bbd15478
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO manipulation tactic. The embedded text, though partially corrupted, includes a URL that appears to be part of this scheme. The ML classifier strongly indicated maliciousness, and the PDF structure with numerous external links is a common technique for distributing malicious content or driving traffic to compromised sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jcitaipei.org/uploads/1/3/0/4/130483351/130483351.html#richard+herrnstein+and+charles+murray%27s+1994+book+the+bell+curve+argued+that+quizlet
    • http://www.paxcommunications.com/uploads/1/3/0/7/130740025/7704450.pdf
    • http://www.hbu5308portfolio.com/uploads/1/3/0/6/130622023/ade6a66ec.pdf
    • http://cbdpowerbars.org/uploads/1/3/0/7/130738779/reruf.pdf
    • http://www.lisenkalami.com/uploads/1/3/0/7/130775850/8190741.pdf
    • http://www.bailaymeditaibiza.com/uploads/1/3/0/6/130604750/1234403.pdf
    • http://sustainable-self.com/uploads/1/3/0/3/130379331/7439588.pdf
    • http://scvfootballcamp.com/uploads/1/3/0/6/130604283/414a6e61.pdf
    • http://tamayotoler.com/uploads/1/3/0/3/130323318/nemamafol.pdf
    • http://almanaquecircular.com/uploads/1/3/0/3/130323454/zemedofurevidi-wolaniviwol-rapulusi-tojitumiwexute.pdf
    • http://josephmcinerney.com/uploads/1/3/0/5/130589299/lewasopebojifaje.pdf
    • http://miraclecreations.shop/uploads/1/3/0/3/130313671/8992349.pdf
    • http://www.tierrajbeauty.com/uploads/1/3/0/6/130605347/jedeferinuvokoje.pdf
    • http://eaarmada.com/uploads/1/3/0/7/130776388/2be3074d1e8eac.pdf
    • http://planetoftalent.com/uploads/1/3/0/5/130544446/rabawed.pdf
    • http://katypoolservice.net/uploads/1/3/0/5/130541221/vodugave.pdf
    • http://www.theintentionalwellnessgroup.com/uploads/1/3/0/8/130813999/4e952.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101ec.bin
21640b51c7e68544505ee52a785798822684a5fd5246e715c8201ed11e1eb42e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101EC 8968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.