Malicious PDF — malware analysis report

Static analysis result for SHA-256 6319c093dba3971c…

MALICIOUS

PDF

38.0 KB Created: 2020-04-02 10:59:29 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3f85ebafd3fbfadedaa3a3bc0c7b0f84 SHA-1: 124046836f6939e496433571cc6a48035e56f1d0 SHA-256: 6319c093dba3971c53e9b91e5e73daa1437c402b5ca640226a914cd5df0cac57
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many of which point to PDF files hosted on unrelated domains. The document body, though heavily obfuscated, contains a URL that appears to be a lure for a product listing. The presence of numerous external links suggests a link farm or a mechanism for distributing further malicious content, likely through a phishing pretext. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adoptme.info/uploads/1/3/0/6/130639757/130639757.html#dremel+moto+saw+blades+for+wood
    • http://szafroncreative.com/uploads/1/3/0/6/130621128/18ebbf35512d.pdf
    • http://goneremote.co/uploads/1/3/0/9/130969235/xusefim.pdf
    • http://countryside-creations.com/uploads/1/3/0/8/130874669/tuzifojan.pdf
    • http://surrendermenot.com/uploads/1/3/0/5/130540178/vikopewupe-rumesitokivi-lawuniposogobi-tipup.pdf
    • http://internationalonlinehomeschool.org/uploads/1/3/0/5/130538841/c1c6004a3.pdf
    • http://wonderust.com/uploads/1/3/0/8/130813504/wudamaxapaz-gopofaduzuga-sogajenojized-bukalijelipapis.pdf
    • http://celenko.com/uploads/1/3/0/4/130435644/tudote-jimojebebudus-gixinowugelup-barufe.pdf
    • http://india108.com/uploads/1/3/0/5/130543740/85306575824.pdf
    • http://pcdsing.com/uploads/1/3/0/2/130289235/lidelina_finevuxirepa_sonulifimoxepu.pdf
    • http://adriantippetts.com/uploads/1/3/0/2/130288926/8bcdf29022776.pdf
    • http://insanityunhinged.com/uploads/1/3/0/4/130435546/fenagobed-nofutususu-rapegog-givedab.pdf
    • http://watchesofbritain.com/uploads/1/3/0/4/130436458/368664.pdf
    • http://mydigibong.com/uploads/1/3/0/7/130775737/530d9357e4cba78.pdf
    • http://slidemountaincabins.com/uploads/1/3/0/5/130544090/086ede60b3b.pdf
    • http://asphaltpleasurescyclegear.com/uploads/1/3/0/6/130603922/2926502.pdf
    • http://needahbasket.com/uploads/1/3/0/6/130621591/befomujijila.pdf
    • http://paperbirchyoga.com/uploads/1/3/0/7/130738799/purewibilav.pdf
    • http://itsthick.us/uploads/1/3/0/2/130291971/pekikodokebiti-madul.pdf
    • http://projectjumpstartgeorgia.com/uploads/1/3/0/2/130270746/a546fcd6.pdf
    • http://u3techsolutions.com/uploads/1/3/1/4/131407547/c3758d4c8c.pdf
    • http://g.greenacrescanoe.com/uploads/1/3/0/3/130379612/saralajakufuxi.pdf
    • http://drduany.com/uploads/1/3/1/3/131383575/8318237.pdf
    • http://clovisglassclass.com/uploads/1/3/0/4/130488615/eccc9aaefa0b.pdf
    • http://justkeepinitcleansoap.shop/uploads/1/3/0/8/130814508/d4b76adb9c.pdf
    • http://mymaplehillfarm.com/uploads/1/3/0/3/130323127/071b518.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a34.bin
5ca137b2301fd6db8101b24b73292ae6c43759f036da89072b41e493ffc59ebb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A34 8284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.