PDF malware analysis — malicious · 658d176763c39260

MALICIOUS

PDF

45.6 KB Created: 2020-04-01 11:44:22 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 6e08a5be968eaeb7581f2124169d6a23 SHA-1: 4f04909f97f38e455d2260637503227a861b6abf SHA-256: 658d176763c39260d3ff5a7ba7b8f683c482320418bd571c2a001de405b019f7

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. These links point to numerous PDF files hosted on various domains, suggesting a tactic to manipulate search engine results or distribute malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://903pros.com/uploads/1/3/0/6/130621554/130621554.html#hormonas+tropicas+de+la+adenohipofisis
- http://webdisk.ladse.org/uploads/1/3/0/2/130288399/2089235.pdf
- http://thcorganicfarms.com/uploads/1/3/0/7/130775018/d1eb6e58.pdf
- http://emmareavesphotography.com/uploads/1/3/1/0/131070525/pategidotome-laxer-tamegonazo-favubisemefesiv.pdf
- http://dainteasanddoilies.com/uploads/1/3/0/7/130775471/2204774.pdf
- http://theladyofthestones.com/uploads/1/3/0/4/130476033/rofex.pdf
- http://dgiindex.biz/uploads/1/3/0/6/130604563/96162b6256503.pdf
- http://healthystrategiespllc.com/uploads/1/3/1/4/131406861/3653475.pdf
- http://dbooher.com/uploads/1/3/0/4/130483319/fitatederupud.pdf
- http://naturepathwc.com/uploads/1/3/0/6/130621757/39285a51f8b305.pdf
- http://saumoidesign.com/uploads/1/3/0/5/130546519/xuxex.pdf
- http://huisartsscore.nl/uploads/1/3/0/5/130590122/donutaxozedini_texogatoxenagu_jaxegoga.pdf
- http://enochian.studio/uploads/1/3/1/1/131164132/396920.pdf
- http://mindmeetscanvas.com/uploads/1/3/0/3/130379243/zagosu.pdf
- http://wakeboatporn.net/uploads/1/3/0/6/130620843/3766756.pdf
- http://theassetlab.com/uploads/1/3/1/4/131438604/5281029.pdf
- http://the-boujee-boutique.com/uploads/1/3/0/7/130740112/mosikujuku_ruladiweguz_newejutafo.pdf
- http://dofnelsonfaithfomation.com/uploads/1/3/1/4/131406656/rulupatiwumuxefo.pdf
- http://crossfit-alhambra.com/uploads/1/3/0/6/130621369/7472704.pdf
- http://lilyrybar.com/uploads/1/3/0/5/130550660/4126329.pdf
- http://avtagrovallestala.com/uploads/1/3/0/6/130640015/5959882.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000876a.bin` `8ea6f96f3a1e6b74aa191d10cde8d2a799d04d3575a155028365b29af5da738e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x876A	8680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.