Malicious PDF — malware analysis report

Static analysis result for SHA-256 65ca4ccd1e752db5…

MALICIOUS

PDF

44.7 KB Created: 2020-03-09 08:01:05 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b908b6d3270f0951dd63b0c6337108d0 SHA-1: d75b8c879abe7b4e3883b17eadb841f6c68e9b0c SHA-256: 65ca4ccd1e752db5fe0e09cad4a809f44c72fea0acffd386b57d02864af47a7c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or SEO spam operation. The ML classifier also strongly indicated maliciousness. The primary goal appears to be directing users to these external resources, which could host further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lunatictechnology.com/uploads/1/3/0/8/130874490/130874490.html#photography+iso+shutter+aperture
    • http://printsign.se/uploads/1/3/0/6/130605122/vafemomi.pdf
    • http://fc.bethalto.org/uploads/1/3/0/8/130874642/gesadu.pdf
    • http://newmexicomade.com/uploads/1/3/0/3/130379142/sibin.pdf
    • http://pwinthtwe.com/uploads/1/3/0/6/130603745/5760223.pdf
    • http://948.bpmtc.com/uploads/1/3/0/8/130874050/4371226.pdf
    • http://mypricelesspetals.com/uploads/1/3/0/3/130379143/0cf4b.pdf
    • http://sustainablythin.com/uploads/1/3/0/5/130539838/f56301ec29613cd.pdf
    • http://redstoneinvestment.ca/uploads/1/3/0/2/130270996/barogira-jevoligoxep-serijuger.pdf
    • http://johnreidmimicry.com/uploads/1/3/0/5/130588616/f76941ee40.pdf
    • http://avispire.co.uk/uploads/1/3/0/4/130476351/93c45285f.pdf
    • http://workerdesigns.com/uploads/1/3/0/7/130739530/2441157.pdf
    • http://mx.heritagegspkennels.com/uploads/1/3/0/7/130739101/5581811.pdf
    • http://nhnextgen.dk/uploads/1/3/0/7/130776847/8838828.pdf
    • http://askthetutor.ca/uploads/1/3/0/4/130488820/c40080.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000070a9.bin
846378590c43ac8c381f0e9d61890a8878142b99ef9603af966f4e2dcd532b70		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70A9 7812 bytes
font_01_sfnt_off00008f24.bin
f19dc41d490b60033b52f2fdde74623f1ba9924597607807c173cf149651756c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F24 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.