Malicious PDF — malware analysis report

Static analysis result for SHA-256 619c6d35d5f0a900…

MALICIOUS

PDF

46.8 KB Created: 2020-03-21 02:46:59 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f80967b10f15cb571d420b3c3b8a7b91 SHA-1: 4905964b1afc33ec5eda5306e2d197f0c7a90506 SHA-256: 619c6d35d5f0a90075bafefb1bd145e69559719a8b410f739b7ed893d7f50d1e
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links to other PDF files hosted on various domains, indicating a link farm or SEO poisoning strategy. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external URIs supports this assessment. No scripts were extracted, and the document body text is largely garbled, making it difficult to determine a specific lure beyond the link farm. The primary attack pattern appears to be directing users to a network of malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wegotyoufoundation.org/uploads/1/3/0/5/130544635/130544635.html#sacar+volumen+de+prisma+rectangular
    • http://bordernomics.org/uploads/1/3/0/8/130813906/4709435.pdf
    • http://needfulwears.com/uploads/1/3/0/2/130289550/pudadavotozekugideza.pdf
    • http://casettedemo.com/uploads/1/3/0/6/130620519/vomiv.pdf
    • http://moldinspectiontestingandawareness.com/uploads/1/3/0/5/130544243/691426177f.pdf
    • http://songimages.com/uploads/1/3/0/5/130550967/zafepixewanodo.pdf
    • http://74-123-73-35.mgwnet.com/uploads/1/3/0/2/130289019/8911130.pdf
    • http://middlesistercocktails.net/uploads/1/3/0/6/130603865/4453236.pdf
    • http://topviewrealstate.com/uploads/1/3/0/3/130323196/1799652.pdf
    • http://www.pioneervalleywritersworkshop.com/uploads/1/3/0/7/130738740/gowadilati-sisimo-torixutigikejox.pdf
    • http://shoponesunday.com/uploads/1/3/0/4/130475921/4100834.pdf
    • http://redwillowproductions.com/uploads/1/3/0/6/130621648/a2cf505.pdf
    • http://newglasssingapore.com/uploads/1/3/0/6/130621257/venajizop-niwabekajibepuz-mipog-zezuz.pdf
    • http://aquickfixatlantahandyman.com/uploads/1/3/0/7/130775624/zofagezevipavenajime.pdf
    • http://mta-sts.mail.lumieregardens.com/uploads/1/3/0/7/130739564/nutevofibezoludem.pdf
    • http://www.wecanbeheroes.info/uploads/1/3/0/3/130313198/9aeaf4980669ee.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071b4.bin
ddc896298aa40c33e8cfe8aec18968f7110a58d8895f7de63065240fec5d0feb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71B4 9188 bytes
font_01_sfnt_off000092e8.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x92E8 1708 bytes
font_02_sfnt_off00009b4f.bin
d15bee2c8b97ad99451c7d0e5f2dde1b71447a586908bd901620b957bd88f686		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B4F 16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.