Malicious PDF — malware analysis report

Static analysis result for SHA-256 654a96a24e33892a…

MALICIOUS

PDF

38.8 KB Created: 2020-05-16 20:55:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8fc85d35bd5c62bbc79359bad61312ca SHA-1: 0c210a3ace5535db47c56ff7136627959f1abf9f SHA-256: 654a96a24e33892a8708d28a45ffc3afdf90fd3bfd02161f068feec3547b868d
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which point to PDF files with numeric slugs, suggesting a link farm designed to drive traffic or distribute malicious content. The document body mentions 'Whatsapp for pc free' and includes a QR code lure, indicating a phishing or social engineering attempt. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://paperowlpress.com/uploads/1/3/0/4/130483631/130483631.html#whatsapp+for+pc+free
    • http://gailwrites.com/uploads/1/3/0/5/130540040/webuwaniwawasu.pdf
    • http://high-rail.org/uploads/1/3/0/3/130312983/fb6753498fbd.pdf
    • http://erictharris.com/uploads/1/3/0/7/130776485/noguzijexixotumem.pdf
    • http://distribuidora.org/uploads/1/3/1/1/131163863/980043.pdf
    • http://faszination-gewalt.com/uploads/1/3/0/7/130739449/xudefotu_lovax_lukaginesiwa_katesibifogowi.pdf
    • http://stairliftsonsale.com/uploads/1/3/0/6/130639407/288298.pdf
    • http://thesandgirls.com/uploads/1/3/0/4/130435929/wariwawuvim.pdf
    • http://newsolitude.org/uploads/1/3/1/4/131483235/tujazekusu.pdf
    • http://comparibuilt.com/uploads/1/3/0/4/130483163/2306323.pdf
    • http://stellarvoice.org/uploads/1/3/0/4/130488092/3710661.pdf
    • http://harfordcountystudentwork.com/uploads/1/3/1/4/131483167/0dc69f4926.pdf
    • http://thehybridacademy.com/uploads/1/3/0/8/130874307/vuvokuf.pdf
    • http://divotsports.com/uploads/1/3/1/4/131407855/jenoratupabavenipu.pdf
    • http://dtukajak.dk/uploads/1/3/0/9/130969209/4868662.pdf
    • http://314printhouse.com/uploads/1/3/0/6/130605254/be7514aa4.pdf
    • http://biohaircarethailand.com/uploads/1/3/0/8/130814591/7095740.pdf
    • http://gringavera.com/uploads/1/3/0/8/130874163/a78851c1.pdf
    • http://midvalleycars.net/uploads/1/3/0/6/130604574/9269303.pdf
    • http://struth.com/uploads/1/3/0/2/130271179/somegigemajowal.pdf
    • http://mphsdemocrats.com/uploads/1/3/0/5/130539357/kadoxaduvuzif_fudanowo.pdf
    • http://ironsideacres.com/uploads/1/3/0/8/130874518/muxeguxib-bovegi-nekopunubil.pdf
    • http://lovelejewellery.com/uploads/1/3/0/5/130551795/ruxur.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006cec.bin
79f15e6ac5749360556c2d3e483138feafda7be1fb75c68a21575b6687956272		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CEC 10204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.