Malicious PDF — malware analysis report

Static analysis result for SHA-256 66c35e8fca6b61e5…

MALICIOUS

PDF

35.8 KB Created: 2020-03-29 05:38:28 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b83ccdb6ced59dc43ef9d7136302ba2b SHA-1: b0deb04489de90d6947c7ecd2db68d792458c209 SHA-256: 66c35e8fca6b61e52d7f10c8cfc931b26ea395b61619f116cc70dfae65970457
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document is identified as a phishing lure due to its small size and image-only content, designed to trick users into clicking embedded links. The document contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO manipulation tactic. The primary link directs to a .html file, likely serving as a landing page for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 35 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://shopbelfast.info/uploads/1/3/1/4/131437162/131437162.html#kyocera+km-3035+manual
    • http://www.championyorkiepuppies.com/uploads/1/3/1/0/131070294/f989dba3b.pdf
    • http://littletreemassage.com/uploads/1/3/1/0/131070761/2a9ff506aa2.pdf
    • http://stakemywallet.com/uploads/1/3/0/7/130738738/gafiravozazafi-donixosededog-vuminiwojovewuz-nojesexoxezo.pdf
    • http://jolyongray.com/uploads/1/3/0/8/130814360/gevexuwim_funulegomi_sofesikopujovef_jumagof.pdf
    • http://westcoastwhitening.com/uploads/1/3/0/4/130436441/b4477eef9d.pdf
    • http://yogasimplifiedmethod.com/uploads/1/3/0/6/130621465/6649730.pdf
    • http://chessmatchonthepitch.com/uploads/1/3/0/8/130874095/munifenofipokezizobe.pdf
    • http://www.keladryfarm.com.au/uploads/1/3/0/6/130640197/58482.pdf
    • http://www.mikejamescalvert.com/uploads/1/3/0/6/130603888/3966753.pdf
    • http://learninglifestyleproject.net/uploads/1/3/0/5/130550847/laruxewodolujino.pdf
    • http://hostmaster.blackhorsestables.lt/uploads/1/3/0/8/130874313/6693d47febb165.pdf
    • http://igclegal.com/uploads/1/3/0/6/130605194/0287b.pdf
    • http://www.summerccc.com/uploads/1/3/0/2/130272918/nolusur_jowewejajimujul.pdf
    • http://www.tekkieai.com/uploads/1/3/0/7/130776416/nusezujinikamol_liluvadotural.pdf
    • http://pitkulup.net/uploads/1/3/0/4/130483953/tezomobezaduge.pdf
    • http://ctdc.ca/uploads/1/3/0/3/130379596/gededesezajozik.pdf
    • http://www.allbailbonds.org/uploads/1/3/0/5/130589393/sujazekagomu_jetijen_delerumemojeje.pdf
    • http://ruraled4kids.org/uploads/1/3/0/3/130379193/5721377.pdf
    • http://www.pureglowbeautystudio.com/uploads/1/3/0/4/130488223/safolexos_vizanatasujoda_jatumisomap.pdf
    • http://reneegdesigns.com/uploads/1/3/0/6/130620982/fataje.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006cd8.bin
622b0dd31170c86ee3ba083f13533178489b361914e950c57130e1f5cdfd051a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CD8 5048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.