Malicious PDF — malware analysis report

Static analysis result for SHA-256 63a2fbde9edeb629…

MALICIOUS

PDF

44.5 KB Created: 2020-03-24 15:16:55 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f7d1fafb6a379015ef2454f1137b85c2 SHA-1: d2df1b3a341a43de76acb7a17cb61a23b6e5556e SHA-256: 63a2fbde9edeb6294c24d86c9d976a2f47bb0d735cf0ce9b821145f0a026bfd9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ML classifier also strongly indicated maliciousness. This suggests the document is part of a link farm or SEO poisoning scheme, potentially distributing malware or phishing content through the linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grupoforrajeroxalos.net/uploads/1/3/0/3/130313539/130313539.html#literatura+clasica+griega+y+romana+ejemplos
    • http://virtue-osity.com/uploads/1/3/0/2/130288751/burof-welobumikegu-dizuzunegizo.pdf
    • http://in-ciderorchard.com/uploads/1/3/0/2/130274256/gidemojitepewo_ziketanelejuner_samatux.pdf
    • http://webdisk.regionalretirement.org/uploads/1/3/0/7/130775049/gupem-temumipojitami-fepoveze-piwubevison.pdf
    • http://susiebogard.com/uploads/1/3/1/0/131070302/mevotojogakadomapu.pdf
    • http://alicemaselnikova.com/uploads/1/3/1/0/131069906/wojesa.pdf
    • http://mobowlusa.com/uploads/1/3/0/4/130477719/kapokosunefu.pdf
    • http://broadweekendmba.com/uploads/1/3/0/3/130312925/b5f110bb1.pdf
    • http://www.smallbusiness.rkfischer.com/uploads/1/3/0/7/130738882/3034533.pdf
    • http://www.retify.online/uploads/1/3/0/9/130969130/791177ed.pdf
    • http://sngprinting.com/uploads/1/3/0/6/130620546/fivusadum_kegaxezubirider.pdf
    • http://mastertheclass.net/uploads/1/3/0/6/130639397/lutofu-kegud-visuto.pdf
    • http://mspennylane.com/uploads/1/3/0/4/130483866/xesixag.pdf
    • http://passionatedoula.com/uploads/1/3/0/5/130545185/pelufoku.pdf
    • http://allbodiesbeautiful.com/uploads/1/3/0/8/130813059/dosadav_bizijijubipozo.pdf
    • http://qbedsandbedding.com/uploads/1/3/0/5/130589205/99a215c10c0d.pdf
    • http://chiefraybrooks.com/uploads/1/3/0/8/130813489/7977c24e.pdf
    • http://ashialane.com/uploads/1/3/0/5/130547405/fivogesevol.pdf
    • http://jobdotjoy.net/uploads/1/3/0/3/130323603/8143e360.pdf
    • http://stevenhuffministries.org/uploads/1/3/0/7/130740363/5b1ba310fe.pdf
    • http://www.newiptvitalia.com/uploads/1/3/0/7/130739340/melazoxoled.pdf
    • http://startapper.com/uploads/1/3/0/8/130814101/421f8.pdf
    • http://haarstudio88.com/uploads/1/3/0/5/130546294/ranazudil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000082c9.bin
b61dbbbf605031f519aeae0bdf24f2af6207dea909438baa17ad0f8122b73f3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x82C9 8736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.